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Ontario’s Freedom of Information and Protection of Privacy Act, 
which came into effect on January 1, 1988, established an 
Information and Privacy Commissioner as an officer of the 
Legislature to provide an independent review of the decisions 
and practices of government organizations concerning access 
and privacy. The Commissioner is appointed by and reports to 
the Legislative Assembly of Ontario. The Commissioner is 
independent of the government of the day in order to ensure 


impartiality. 


The Municipal Freedom of Information and Protection of Privacy Act, 
which came into effect January 1, 1991, broadened the number 
of public institutions covered by Ontario’s access and privacy 


legislation. 


The Information and Privacy Commissioner (IPC) plays a 
crucial role under the two Acts. Together, the Acts establish a 
system for public access to government information, with limited 
exemptions, and for protecting personal information held by 


government organizations at the provincial or municipal level. 


The provincial Act applies to all provincial ministries and most 
provincial agencies, boards and commissions; colleges of 
applied arts and technology; and district health councils. The 
municipal Act covers local government organizations, such as 
municipalities; police, library, health and school boards; public 


utilities; and transit commissions. 


Freedom of information refers to public access to general 
records relating to the activities of government, ranging from 
administration and operations to legislation and policy. The 
underlying objective is open government and holding elected 


and appointed officials accountable to the people they serve. 


Privacy protection, on the other hand, refers to the safeguarding 


of personal information - that is, data about individuals held by 
government organizations. The Acts establish rules about how 
government organizations may collect, and disclose personal data. 
In addition, individuals have a right to see their own personal 


information and are entitled to have it corrected if necessary. 


The mandate of the IPC is to provide an independent review 
of government decisions and practices concerning access and 
privacy. To safeguard the rights established under the Acts, the 
IPC has five key roles: 


e resolving appeals when government organizations 
refuse to grant access to information; 

e investigating privacy complaints about government 
held information; 

e ensuring that government organizations comply with the Acts; 

e conducting research on access and privacy issues and 
providing advice on proposed government legislation 
and programs; 

e educating the public about Ontario’s access and 


privacy laws, and access and privacy issues. 


In accordance with the legislation, the Commissioner has 
delegated some of the decision-making powers to various staff. 
Thus, the Assistant Commissioner and selected staff were given 
the authority to assist her by issuing orders, resolving appeals and 
investigating privacy complaints. Under the authority of the 
Commissioner, government practices were reviewed and one 


indirect collection of personal information was approved in 2001. 
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The year began with the continuing fallout from the deflating Internet stock bubble and concerns that 


the economy was sliding into recession. Then, suddenly, none of that mattered. 


The bombing of the World Trade Center on September 11, the 
mailing of anthrax spores to members of the media and polit- 
ical officials, and the launch of the “war” against terrorism 
dramatically, and perhaps irrevocably, changed our world. It is 
difficult to overstate the effect of these events on our lives, 
whether we were directly affected or simply caught up in the 
aftermath. Regardless, we have all been witness to the height- 
ened levels of security in airports, border crossings and other 


high-risk areas. 


This focus on security and public safety has caused serious 
repercussions for privacy and for access to government 
information. Over the next few years, I expect we will see the 
introduction of new forms of identification that are more 
tamper resistant and less susceptible to fraud. We will also 
likely witness the expanded use of biometrics (the use of a 
physical measure such as a finger print, facial geometry or iris 
pattern) on passports and other identification cards. The use of 
video surveillance will most likely also grow in both public and 


private places. 


Clearly there are challenges facing governments and law 
enforcement agents as they strive to protect their citizens. To 
this end, Canada has taken a number of measures, including 
the passage of the federal Anti-terrorism Act and the expendi- 
ture of significant financial resources to promote security and 
to fight terrorism. However, it is important to remember that 
the goal of these efforts is to protect our democratic society and 
its citizens - not to create a state in which people fear for their 
privacy as much as their security, or one where public 
openness, transparency and accountability are swept aside 
under the misguided view that the these fundamental demo- 


cratic principles must be subservient to the needs of security. 


Our laws recognize the impor- 
tant and legitimate role that law 
enforcement agencies play in 
ensuring public safety. While 
public safety is a vitally impor- 
tant value, it must be balanced 
against other values, including 
privacy, and the right to expect 
governments to continue to be 


held publicly accountable for 


their actions through access to 


Ann Cavoukian, Ph.D. 


Information and Privacy Commissioner 


information laws. Any dimin- 
ishing of our rights deemed 
necessary in response to a recognized threat to our collective 
safety must be done in a manner that does not undermine the 
democratic traditions that characterize our society. To do 
otherwise would be to defeat the purpose of fighting to preserve 


the values we hold dear. 


Throughout the fall, I attempted to raise awareness of the need 
for balance when governments are considering their response 
to these unknown threats. I wrote to the federal Attorney 
General expressing concerns over a number of elements of the 
Anti-terrorism Act; released a key paper, Guidelines for Using 
Video Surveillance Cameras in Public Places; and launched a new 
initiative called STEPs — Security Technologies Enabling 
Privacy. Our goal with STEPs is to convince governments, law 
enforcement agencies and security vendors that security 
measures do not, by necessity, have to violate people’s privacy 
in order to be effective. I will continue to speak out against 
anyinitiative that I believe is ill-considered and over-reaching, 
and that attempts to promote security without due regard to 


privacy and access considerations. 
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LOOKING AHEAD 


Thankfully, not all the events in 2001 were cause for concern. 
In January, the federal private sector privacy law, the Personal 
Information Protection and Electronic Documents Act, came into 
force. That law, which initially applies to federally regulated 
organizations involved in commercial activities, gives individ- 
uals the right to see and ask for corrections to personal 
information collected by these organizations, and governs the 


way this information is used and disclosed. 


The Ontario government is committed to a “made-in-Ontario” 
private sector privacy law that will cover all organizations — 
including those in the health sector — presently not covered by 
the public sector legislation. For much of the fall, the Ministry 
of Consumer and Business Services worked on this legislation, 
and a draft bill was released in March 2002 for public 
comment. Wide-ranging consultation on the draft of the 
Privacy of Personal Information Act should lead to the develop- 
ment of a comprehensive and effective law that we hope will be 


introduced for legislative debate by mid-2002. 


ISSUES 


Similar to past years, this annual report will review a number 
of important issues that have either arisen over the course of 


the year or are on the horizon. 


This year’s report focuses on five issues. We expand on the 
important themes I raised earlier in this message in The new 
security challenge: Making security technology privacy protective. 
In keeping with our efforts to deal with appeals through the use 
of alternative dispute resolution methods, we discuss Mediation: 
The benefits — and challenges. The contentious issue of law 


enforcement agencies’ use of video cameras in public places is 
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reviewed in Video surveillance: First make sure it’s necessary; then 
build in very strong safeguards. In Use of discretionary exemptions 
should never be automatic, we emphasize the need for government 
institutions to properly exercise discretion when making access 
decisions, particularly those involving access to one’s own 
personal information. And, the complex issue of access to infor- 
mation held in public registries is discussed in Public registries 


should be covered under Ontario access and privacy legislation. 


This report highlights the work of this office over the course of 
the year, including another enhancement of our popular school 
program that now includes a teacher’s guide for Grades 11 and 
12. We report on the increasing number of appeals received, 
and the significant number of speaking engagements and 
media interviews. Also highlighted are a number of joint 
initiatives we have undertaken to promote access and privacy 
throughout the public and private sectors. The demands on my 
office for involvement in a wide range of speaking events and 
collaborative and consultative projects grows significantly each 
year, and shows no sign of slowing down, especially in light of 


pending provincial privacy legislation. 


PERSONAL THANKS 


Each year, the demands and expectations on my office grow 
and my incredible staff rises to these challenges. I have received 
compliments from around the world on the professionalism of 
my staff and the high quality of our publications and decisions. 
I am very grateful for the dedication, determination and 
fundamental belief in the values of our work that each staff 
member brings to the job every day. Perhaps at no other time 
in recent memory have access and privacy matters garnered so 
much public interest, nor have they been such important issues 
of public policy. I offer my sincere thanks to my staff, without 


whom, the task would indeed be a daunting one. 


THE NEW SECURITY CHALLENGE: 


MAKING SECURITY 


TECHNOLOGY PRIVACY—PROTECTIVE 


At a recent conference, the president of a software company showed a Slide stating that the difference 


between security and privacy was that security deals with technology and privacy deals with policies. 


Many companies mistakenly assume this paradigm is correct. 


Firewalls, encryption algorithms and access controls, they 
believe, can address security issues; while privacy is 
ensured through policy statements, training and education. 


Unfortunately, it’s not that simple, nor is that statement accurate. 


In the United States, where privacy is a hotly debated but 
under-legislated topic, chief privacy officers (CPOs) tend to shy 
away from “architecture of privacy” discussions. (Although 


there are several noteworthy exceptions.) 


Dr. Larry Ponemon, chief executive officer of privacy consulting 
firm Privacy Council, concluded from a recent survey of organi- 
zations with CPOs that there is a lot of talk but not much walk 


when it comes to protecting privacy in the private sector. 


This may in part be attributed to the false “privacy = policy” 
paradigm. As a result of this misconception, companies tend to 
overlook the privacy protections that must be addressed at the 
source code and technology design level. Instead, they focus on 
privacy policies. While essential, policy — without the necessary 
focus on technology design and implementation — faces the risk 


of becoming window dressing. 


For Ontario’s private sector, there are a few lessons to be 
learned by examining the limitations of the privacy = policy 
paradigm. First, it is important to realize that there are other 
privacy models. In Europe, privacy means —“data protection.” 


The focus on data creates a key role for technology in the 


European model. This privacy paradigm, which includes 
policy and legislation, has data at its epicenter. Today, the data 
protection discussion in Europe quickly turns to the use of 
and other enhancing 


seudonyms, encryption orivacy 
P yy, yp I y 


technologies to protect personally identifiable data. 


The European Union Directive 95/46, Article 17, explicitly 
“requires data controllers to implement appropriate technical 
These 
should be taken both at the time of the design of the processing 


. measures to protect personal data.... measures 


system and at the time of the processing itself.” 


Some European countries have already introduced this 
requirement into national legislation. The justice minister of 
the Netherlands, on the eve of proclaiming its national privacy 
legislation, asked companies to “consider partial or complete 
“anonymising” ... by eliminating from personal data their 
(consumers’) personally identifying characteristics.” This focus 
on privacy through technology is not the norm for most North 
American CPOs, especially if their areas of expertise centre on 


policy, marketing or law. 


But it is exactly this focus on technology and its key role in 
protecting privacy that stands as a major challenge for the 
private sector. For those companies that have begun to invest in 
the technology design, or “privacy architecture,” the strategic 


discussion soon centres on technology design issues. 
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There are two reasons for this. First, the personal data that an 
organization collects, warehouses and mines forms the founda- 
tion of customer relations management (CRM) and business 
intelligence activities. That foundation needs to be built with 
privacy-protective rules in place in order to comply with 
Canadian and (pending) Ontario privacy legislation. In short, 
it is an information management issue that has, at its core, the 
need to give control of the data to the individual who provided 
their personal information. These privacy-protective rules 
need to be built into the most fundamental levels of systems 
design. As Stanford law professor Lawrence Lessig states, “We 
must build into architectures a capacity to enable choice.... 
The architecture must enable machine-to-machine negotia- 
tions about privacy so that individuals (consumers) can instruct 


their machines about the privacy they want to protect.” 
So what can be done? What should be avoided? 


Let’s address the latter first. One step that should be avoided 
whenever possible is simply to add a privacy mandate onto that 
of a chief information officer or chief security officer. These 
functions can clash. The chief security officer is focused on 
ensuring that the organization’s security systems give complete 
control of the data to the organization. The chief privacy 
officer needs to focus on how the control of data can remain in 
the hands of the individual. When the two oversight roles are 
combined, the privacy issues all too often get short shrift. This 
is not to say that both functions cannot be designed into a 


single piece of technology. Quite the contrary. 


As sketched out in the European data protection model, this 
means restricting collection of personal information, intro- 
ducing pseudonyms and other privacy-enhancing technologies, 


while instituting a layered approach to security controls. 
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Let us turn to what can be done. First and foremost, 
chief privacy officers must be sufficiently conversant in 
technology matters to communicate effectively with the chief 
information/technology/security officer regarding the privacy 
requirements that need to be built into the technology. There 
are many resource tools available for companies faced with 
burgeoning databases of consumer information that need to be 


stored, used and managed in a privacy-protective way. 


A few companies have been quick to see a market in this area 
and have developed privacy management and privacy rights 
management applications that allow controls to be placed on 
personal data. These reflect the levels of consent that an 
individual gives for the use and disclosure of his or her 
personal information at the time it is collected. Other tools, 
such as design embedded privacy risk management and privacy 
threat assessments, address the privacy issues at the technology 
level. Privacy impact assessments and privacy audits approach 
the problem primarily from a risk management and post- 


implementation perspective. 


In addition to these tools, the IPC, with the assistance of 
Guardent Inc. and PricewaterhouseCoopers, developed a 
simple-to-use Privacy Diagnostic Tool (PDT). The PDT allows 
organizations that are in the first stages of addressing privacy 
to run a self-assessment by answering key questions based on 
the 10 internationally recognized fair information practices. 
The PDT Vis” available: free of charge “from the IP 


(www.ipc.on.ca). 


So far, we have focused on the steps that chief privacy officers 


and companies that employ technology solutions can take. 


There is an important role for “solution providers” as well. More 
and more technologies need to be developed with privacy protec- 


tions already built in. These include: 


e privacy-enhancing technologies (PETs) that use various 
techniques to keep control of personal information in the 


hands of the consumer; and 


e security technologies enabling privacy (STEPs), a new class 
of technologies that are both security and privacy 
enabling, to answer the heightened security concerns 


post-September 11, without jettisoning privacy protections. 


Solution providers and technology developers also have a role 
to play in developing privacy tools. Potentially privacy-invasive 
technologies, such as biometrics, electronic surveillance, data 
mining, and various types of imaging, sensing and other 
emerging technologies can be reframed and designed to serve 
as effective security tools in the fight against terrorism — 
without giving away privacy in the process. By building 
privacy safeguards into the design and framework of security 
technologies, we can improve the actual safety of our airports, 
offices and computer networks without creating the tools and 
conditions that allow for unchecked data mining, massive 


surveillance and invasive body scanning. 


Once established, it will be equally important to ensure that 
sound policies incorporating security/privacy-related technolo- 
gies are built into the standard operating procedures and 


practices of organizations. 


The challenge for chief privacy officers in both the private and 
public sectors is to harness the privacy tools and resources for 
the benefit of both governments/corporations and citizens/ 
customers. It is also the role of the chief privacy officer to 
challenge technology developers to design solutions that 


address both privacy and security, without sacrificing either. 


ONTARIO CPO 


The Ontario government has made e-government (the online 
delivery of services) a priority. Increasingly, the personal 
information of citizens is being collected, stored and used in 
electronic form. The need for the government to address 
privacy as an issue that is distinct from security is therefore 
greater than ever. In the Recommendations section of this 
report, Commissioner Cavoukian urges Ontario to appoint its 


first chief privacy officer. 
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MEDIATION: THE BENEFITS 


AND CHALLENGES 


“The Commissioner may authorize a mediator to investigate the circumstances of an appeal and to try 


to effect a settlement of the matter under appeal” (section 40 of the municipal Act and section 51 of 


the provincial Act). 


In Ontario, we are fortunate that the ability to resolve appeals 
through mediation is addressed directly in the statutes. 
Mediation, simply defined as negotiation between parties that 
are assisted by a neutral third party, is the preferred method of 


dispute resolution at the IPC. 
Some of the key benefits of mediation are: 


e Better results: the resolution is created by the parties. 

e Speed: generally faster than formal adjudication. 

e Cost: time, money and emotion can be saved through 
early resolution of the dispute. 

e Control: the parties maintain control of the dispute and 
its resolution. 

e Improved relationships: can preserve or enhance the 


relationship between the parties. 


Based on 14 years of experience in mediating appeals, it is the 
IPC’s view that mediation can be applied to the full range of 
issues raised in an appeal: exemptions, existence of records, 
jurisdiction, and procedural matters. We are proud that 
between 70 per cent and 75 per cent of appeals are fully resolved 
without the need for a formal adjudication and order. And even 
when appeals are not fully settled, the majority are resolved in 
part, meaning that fewer issues and/or records proceed to the 


adjudication stage. 


Even though mediation has been a successful strategy, IPC 


mediators face a number of unique challenges: 
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LACK OF COMMITMENT 


Some institutions do not take full advantage of the benefits 
of the mediation process. At the outset, they maintain their 
position and state a preference for adjudication because they 
believe that their decisions are “correct.” In so doing, insti- 
tutions often forgo opportunities to put a human face on 
government, one that listens to and works together with its 


customers to try to resolve issues. 


SIGNIFICANT POWER IMBALANCE 


While power imbalances are not uncommon in disputes, in 
the context of an FOI appeal, there is usually a major power 
imbalance: the appellant does not know what the informa- 
tion is that has been denied — after all, that is the subject of 
the dispute — while the institution knows and has control of 


all of the information. 


MEDIATION PROCESS 


Because the denial of information is at the heart of most FOI 
disputes, the mediation process must be more circumspect 
than in a more typical mediation. The mediator cannot just 
call a meeting of the parties, put all of the information on the 
table and then assist them in reaching a resolution. Instead, 
the mediator must ensure that the content of the records in 
dispute is not disclosed during mediation discussions — a 


barrier not present in more traditional mediation. 


INSTITUTION’S MEDIATION REPRESENTATIVE 


The institution’s “mediation representative” is often not the 
person who has a detailed knowledge of the records at issue 
in the appeal, nor — and perhaps more importantly — the 
person who has the authority to bind the institution during 
mediation discussions. In most provincial institutions, the 
Freedom of Information and Privacy Co-ordinator is not the 
delegated decision-maker, yet is the institution’s mediation 
representative. Obtaining approval for mediation proposals is 
too often a time-consuming process yielding unsatisfactory 
results and requiring repeated forays up the chain of 
command. An unfortunate result of this delay is that the 
passage of time often lessens the incentive for settlement and 


increases the appellant’s mistrust of government. 


ACCESS VS. PRIVACY 


In part, the Acts balance the public’s right of access to govern- 
ment records with an individual’s right to protection of 
personal information held by government. Yet, the public’s 
perception is that under “freedom of information,” an 
individual is entitled to access another individual’s personal 
information. IPC mediators have an educational role to play in 


explaining the purposes of the Acts to appellants. 


What 1s the IPC doing to meet these mediation challenges? 


PROMOTING MEDIATION AS THE PREFERRED 
METHOD OF DISPUTE RESOLUTION 


Our access and privacy brochures highlight mediation as the 
IPC’s preferred method of dispute resolution. Perspectives, 
the IPC’s semi-annual newsletter, contains a section devoted 
to mediation success stories. And at speaking engagements 
with institutions and the public, we encourage mediation by 


including it as part of our presentations. 


INCREASED USE OF FACE-TO-FACE 
MEDIATION AND TELECONFERENCING 


In the past, mediation at the IPC was most often conducted 
by telephone, one party at a time, primarily due to concerns 
about discussing the content of the records in exemption- 
based appeals. Over time, however, we have found that even 
where appeals are based solely on denial of access to certain 
records, it is not only possible to mediate with the parties 
together, it is also hugely beneficial in terms of each party 
gaining an understanding of the issues, perspectives and 


interests of the other. 


What can you do to meet these mediation challenges? 


All parties must display: 


+ A commitment to the principles of mediation, and an 


investment in the mediation process; 


e À non-adversarial attitude, and a willingness to “think 
outside the box” and identify creative, innovative resolu- 


tions to particular issues. 
Institutions, in particular, must: 


+ Recognize that access decisions should be made in the 


spirit as well as the letter of the Acts; 


e Have in place a decision-making structure that permits 
the person mediating on behalf of the institution to bind 
the institution or, at the minimum, to quickly obtain the 


necessary authority. 


Over the course of the next several months, the IPC will be 
working with the Ministry of the Attorney General on a pilot 


project focused specifically on removing barriers to mediation. 


Mediation is widely accepted today in both the civil and 
administrative law communities, and its use is expanding to 
include almost every conceivable type of dispute. While clearly 
there are particular challenges in mediating FOI appeals, by 


working together we can overcome them. 
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VIDEO SURVEILLANCE: FIRST MAKE SURE IT’S NECESSARY; 
THEN BUILD IN VERY STRONG SAFEGUARDS 


As video surveillance technology becomes more accessible, government organizations have shown 


increased interest in using it as a law enforcement tool. This interest was accelerated by the 


September 11 terrorist attacks in the United States. 


In Ontario, municipalities and police services are beginning to 
consider the use of public video surveillance systems with 


increasing frequency. 


As the IPC has been emphasizing for over five years, there are 
significant risks to personal privacy associated with a video 


surveillance system, unless very strong safeguards are in place. 


Institutions governed by the provincial and municipal Acts that 
are considering implementing a public video surveillance pro- 
gram must ensure that there is a proper balance between the 
public safety benefits of video surveillance and an individual’s 


right to be free of unwarranted intrusion into everyday life. 


Pervasive, routine and random surveillance of ordinary, lawful 
public activities interferes with an individual’s privacy. 
Widespread video surveillance — Britain is a case in point, with 
approximately 2.5-million closed-circuit television cameras — 


is clearly not acceptable in Ontario. 


The IPC recognizes that, in limited and defined circumstances, 
a video surveillance camera installed in a public place may be 
an appropriate tool available to law enforcement agencies to 
help safeguard security and detect or deter criminal activity. 
Consequently, in October 2001, the IPC issued Guidelines for 
Using Video Surveillance Cameras in Public Places to assist insti- 
tutions in deciding whether the collection of personal informa- 


tion by means of a video surveillance camera is lawful and 
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justifiable as a policy choice, and, if so, how privacy-protective 


measures can be built into the system. The Guidelines address: 


e Important considerations prior to making a decision to 
install a video camera. There must be a strong business 


case predicated on need; 

e Developing the video surveillance policy; 

e Designing and installing the equipment; 

e Developing and posting signage for proper notice to the 
public; 


e Access, use, disclosure, retention, security and disposal 
of records acquired through use of the surveillance 


camera; 
e Auditing and evaluation of the system; and 


e Resources available for those considering the introduc- 


tion of public video surveillance cameras. 


Video surveillance should never be embraced as a panacea. Its 
use as a tool should be limited and specific, and the decision to 
introduce a public video surveillance camera should only be 


made after careful consideration of the following: 


e Have other measures of deterrence or detection been 


considered and rejected as unworkable? 


e Can the use of each camera be justified on the basis of 
verifiable, specific reports of incidents of crime or 


significant safety concerns? 


e Have the privacy risks of introducing the camera been 


assessed and weighed? 


e Has there been consultation with stakeholders, 


including the IPC and the public? 


Once a decision has been made by an institution to introduce 
video surveillance, a written policy (as. outlined in the 
Guidelines) should be put in place governing the operation of 


the system. Some of the requirements are: 


e A description of the use of the surveillance equipment, 
including which personnel are authorized to operate it, 
under what supervision, times when the surveillance 


will be in effect, and the location of the equipment; 


e The institution’s obligations with respect to notice, 
access, use, disclosure, retention, security and disposal of 


records in accordance with the Acts; 


e A statement that the institution will maintain control of 


and responsibility for the equipment at all times. 


It is important that institutions ensure through their documented 
policies that information gathered by video surveillance is only 
used for public safety or law enforcement purposes, and that it is 
retained for a very limited length of time. In addition, clear signs 
should be put in place notifying the public of the presence of any 
camera in the surveillance area. It is also essential that institutions 
conduct regular audits of their compliance with their policies and 
procedures governing video surveillance as well as the use and 


security of the surveillance equipment. 


A critical requirement is that video surveillance systems are 
periodically evaluated to determine whether they are effective 


and justified on an ongoing basis. 


Pervasive use of video surveillance technology, as seen in 


Britain, has not yet been seriously considered in this province. 


On the contrary, municipalities and police services have only 
considered the strategic use of individual video surveillance 


cameras in specifically designated locations. 


To date, the IPC has had constructive discussions with institu- 
tions considering introducing video surveillance technology. 
The IPC believes it is essential for institutions considering video 
surveillance to continue to consult with this office in order to 
ensure that privacy considerations are accurately identified and 


adequately addressed. 
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USE OF DISCRETIONARY EXEMPTIONS SHOULD NEVER 
BE AUTOMATIC 


The provincial and municipal Acts provide members of the public with a right of access to both general 


records under the control of institutions and to personal information about them held by provincial and 


municipal government bodies. 


The Acts state clearly that exemptions to this right of access 
should be limited and specific. In framing the exemptions, the 
legislators made most exemptions discretionary, and only a few 


mandatory. 


Mandatory exemptions require that the information be withheld 


in all cases. 


Discretionary exemptions, on the other hand, permit institutions 


to withhold information, but do not require them to. 


The exercise of discretion is a key component of the access 
process, reflecting the purposes of the Acts, which bear 


repeating: 
+ Information should be available to the public; 


e Individuals should have a right of access to their own 


personal information; and 
e Exemptions to access should be limited and specific. 


IPC orders have established the proper approach to follow 


when exercising discretion. As a general statement: 


An institutions exercise of discretion must be made in full 
appreciation of the facts of a particular case, and upon proper 


application of the applicable principles of law (Order 58). 


What is a proper exercise of discretion? In making a decision in 


response to an access request, institutions must consider the 
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individual circumstances of the request, including factors per- 
sonal to the requester, while also ensuring that decisions 
regarding access conform to the policies and provisions of the 
Acts. While the same factors are not relevant in every circum- 
stance, it is important that all factors that are relevant receive 


careful consideration. 


What is an improper exercise of discretion? It is improper for an 
institution to adopt a fixed rule or policy and apply it in all 
situations. To do so would constitute a fettering of discretion and 
would represent non-compliance with the institution’s statutory 


obligations. Individual circumstances must be considered. 


While the same principles regarding the exercise of discretion 
apply to both general record requests and personal information 


requests, the decision-making process is slightly different. 


When a government institution receives a request for access to 
general records, the institution must deny access to the infor- 
mation if a mandatory exemption applies, but may disclose the 
information even if it qualifies for one or more discretionary 


exemptions. 


In contrast, when an institution receives a request for access to 
that requester’s own personal information, it must disclose this 


information unless one or more discretionary exemptions apply. 


It is important to note that exemptions considered mandatory 


when requesting general records (for example, third 


party commercial information, cabinet records, or another 


individual’s personal information) are discretionary when the 


request is for a requester’s own personal information. 


In all instances when dealing with discretionary exemption 
claims, it is important for institutions to realize and accept that 
just because a record or information satisfies the requirements 
of the exemption, that does not necessarily mean the record 
cannot be disclosed. The institution must take the added step 
of deciding, in the particular circumstances, if the record or the 
requester’s personal information should be disclosed despite 


the fact that it qualifies for exemption. 


In the IPC’s experience, institutions too often apply discre- 
tionary exemptions as if they were mandatory. That is, they 
claim a discretionary exemption simply because they can. They 
don’t take the important step of assessing the particular 
circumstances and deciding whether the record or information 


should nonetheless be disclosed. 


Exercising discretion under the Acts is a complex process and it 
is very important that institutions understand how it should be 
done - whether in the context of general requests, or in the 
expanded context of personal information — and doing it as a 


routine part of the decision-making process 


The IPC recently completed a joint project with the Toronto 


Police Service on the exercise of discretion in the specific context 


of section 38(b) of the municipal Act: Exercising Discretion under 
section 38(b) of the Municipal Freedom of Information and 
Protection of Privacy Act: A Best Practice for Police Services 
(www.ipc.on.ca/english/pubpres/papers/discre.htm). Hope- 
fully, this document will be of assistance to all institutions when 


discharging their responsibilities to properly exercise discretion. 
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PUBLIC REGISTRIES SHOULD BE COVERED UNDER 
ONTARIO ACCESS AND PRIVACY LEGISLATION 


Ontario’s Freedom of Information and Protection of Privacy Act and Municipal Freedom of Information 


and Protection of Privacy Act (the Acts) contain privacy protection rules governing the collection, 


retention, use and disclosure of personal information by government organizations. However, publicly 


available personal information is exempted from the privacy rules in the Acts. 


The largest collections of publicly available personal informa- 
tion in Ontario are known as public registries. The Acts do not 
specifically refer to “public registries.” A public registry, 
though, can be defined as a registry, list, roll or compendium of 
personal information that is maintained by a government 
organization pursuant to a statute, regulation, policy, or 
administrative practice. It is open, in whole or in part, for 


public inspection under a specific law or policy. 


Examples of public registries that are maintained by govern- 
ment organizations and open to the public include the land 
registry, the Personal Property Security Registration system, 


election finance records, and the property assessment rolls. 


There are sound policy reasons for allowing the public to 
inspect public registries that contain personal information 
about individuals. For example, the availability of election 
finance records strengthens democracy by allowing members 
of the public to scrutinize who has been donating money to the 
campaigns of politicians. Similarly, public access to personal 
property or land registry records enhances consumer protec- 
tion by enabling buyers to determine if a would-be seller is the 
actual owner of a car or house and whether there are any liens 


or other encumbrances on these pieces of property. 


In a paper-and microfiche-based world, public registries 
enjoyed a limited measure of privacy protection because of 


what has been described as their “practical obscurity.” In order 
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to inspect a registry, list or roll, an individual would have to 
travel to a government office during prescribed office hours. In 
addition, documents in public registries could only be copied or 


searched on a record-by-record basis. 


But personal information in public registries that are available 
in electronic format or posted on the Internet can be easily 
retrieved, searched, sorted, manipulated and used for purposes 
that have no connection to the original purpose for which the 


information was collected. 


With the click of a mouse, an individual can send an entire 
public registry to another person via e-mail. Direct marketing 
firms can use computer software to collect, sort and combine 
names, addresses and telephone numbers from public 
registries and target consumers with junk mail and unsolicited 


telemarketing pitches. 


More significantly, if a public registry is posted on a government 
Web site and can be searched by name and address, criminals 
such as stalkers and domestic abusers may be able to trace the 
whereabouts of their intended victim through the Internet. 
Identity thieves can more easily access and combine personal 
information from such registries with information gleaned from 
other sources in order to steal the identities of unsuspecting 


members of the public. 


As reported in the press in November 2001, police in Hillsboro, 
Oregon, charged a man with identity theft and forgery after 
they raided his home and found death certificates, Social 
Security cards, and two copies of a CD-ROM containing the 
state’s entire Department of Motor Vehicles (DMV) database of 


vehicle and driver information. 


Oregon Driver and Motor Vehicle Services examined the CD- 
ROMs and found that they contained information from two 
DMV bulk lists that had been legitimately purchased by 
another party in 1997 and 1999 and had somehow ended up in 
the hands of the individual who was arrested by the police. 


In Ontario, the Ministry of Transportation does not sell its data- 
bases of vehicle and driver information to the public in bulk 
form. However, the incident in Oregon illustrates what can 
happen if government organizations make collections of personal 


information available to the public in electronic format. 


The IPC believes that the complete exclusion of publicly 
available personal information from any statutory privacy 
protections in the Acts is unbalanced, outdated and potentially 
dangerous in a digital world. Although the IPC has issued at 
least two orders over the past five years that call on the 
Ontario government to revisit the wholesale exclusion of 
publicly available information from statutory privacy protec- 


tions, no action has yet been taken. 


There are a handful of jurisdictions around the world, such as 
New Zealand and the Australian state of New South Wales, 
which have privacy legislation containing special privacy rules 
that specifically apply to personal information in public 
registries. In addition, under Canada’s federal private-sector 
privacy legislation, the Personal Information Protection and 
Electronic Documents Act (PIPEDA) and its accompanying 
regulations, federally regulated commercial organizations can 
only collect, use and disclose personal information from 
“public registries” for a purpose that is directly related to the 


purpose for which this information appears in the registry. 


The Ontario government has announced its intention to intro- 
duce privacy legislation that would apply to the provincially 
regulated private sector. The IPC will be working to ensure 
that this legislation and its accompanying regulations contain 
provisions that are substantially similar to the clauses in 


PIPEDA that apply to publicly available personal information. 


One option, which would mirror the PIPEDA approach, would 
restrict provincially regulated private organizations’ ability to 
collect, use and disclose personal information from a public 


registry to a purpose that is directly related to the purpose for 


which this information appears in the registry. The implemen- 
tation of a purpose-limitation rule such as this would help 
address the privacy of individuals whose personal information 
is found in public registries in Ontario. However, it is also 
important to ensure that the valid public policy considerations 
that underlie the right of access to information in public 


registries also receive consideration in this context. 


It’s also important to recognize that private-sector privacy 
legislation governing publicly available personal information 
would only impose controls on one group of users: provincially 
regulated private organizations. It would not cover individuals 
or, more importantly, establish a framework for the govern- 


ment organizations that administer public registries in Ontario. 


In the recommendations section of this annual report, the 
Commissioner urges the government to seek public input about 
whether the Acts should be changed to modernize the treatment 
of personal information contained in public registries. Until a full 
public debate has taken place, government organizations that 
administer public registries should err on the side of caution 
when deciding whether to make public registries available 
electronically. During 2002, the Commissioner will be 
contributing to this debate by releasing a paper that proposes an 
approach that would strike a balance between the public’s right 
to access personal information in public registries for legitimate 
purposes, and the privacy rights of individuals whose personal 
information is found in such registries. This paper will also offer 
some privacy-protection tips for the government organizations 


that administer public registries. 
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RECOMMENDATIONS 


(1) PRIVACY LEGISLATION 


I urge the Ontario government to make the proposed new 
privacy legislation one of its priorities for 2002. If given the 
attention it deserves, this much needed legislation, which will 
cover the private sector and the health sector, may be passed 
before the end of this year. Once this becomes law, privacy 


protection for Ontarians will extend beyond the public sector. 


(2) VIDEO SURVEILLANCE 


The collection of personal information via video surveillance by 
provincial and municipal government organizations is subject to 
Ontario’s Freedom of Information and Protection of Privacy Act 
and the Municipal Freedom of Information and Protection of 
Privacy Act. I strongly recommend that any organization subject 
to one of these Acts that is considering the possibility of using a 


video surveillance camera in a public place: 


e review, at the outset, our Guidelines for Using Video 
Surveillance Cameras in Public Places and follow it closely, 


(http://www.ipc.on.ca/english/pubpres/papers/video-gd.htm); 


e advise my office early in the process, and meet to discuss 


the application of our Guidelines. 


(3) CHIEF PRIVACY OFFICER 


One of the fastest growing professional designations is that of 
chief privacy officer (CPO). Recognizing the growing impor- 
tance of meeting customer and client expectations, and the 
requirements of legislation, an increasing number of organiza- 
tions are appointing a senior executive with specific responsibility 
for privacy, not security, since experience shows that privacy 


often takes a back seat when both functions are combined. 
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The Ontario government has made the online delivery of 
services, or e-government, a priority. Increasingly, the personal 
information of citizens is being collected, stored and used in 
electronic form. The need for the government to address 
privacy as an issue that is distinct from security is greater than 
ever. I recommend that the Ontario government appoint a 
senior public servant as chief privacy officer to help ensure that 
its programs are designed and delivered in a manner that both 


protects and enhances the privacy of Ontarians. 


(4) PUBLIC REGISTRIES 


Increasingly, government organizations are making public 
registries available in electronic format, which has significant 
privacy implications. The government should initiate a public 
consultation process to identify how Ontario’s Freedom of 
Information and Protection of Privacy Act and the Municipal 
Freedom of Information and Protection of Privacy Act can be 
amended to properly deal with the treatment of personal 
information in public registries in the electronic world. One 
option that should be raised during the public consultation is 
whether the Acts should be amended to include special public 
registry privacy principles similar to those in New Zealand and 
the Australian state of New South Wales. To ensure an open 
and transparent process, the government should invite 
submissions from all relevant parties, including businesses; 
non-governmental organizations; journalists; regular users of 
public registries; the public bodies that administer public 


registries; and the general public. 


In 2001, the third year of the IPC’s Institutional Relations 
Program, the Tribunal Services Department continued to work 
collaboratively with a number of municipal and provincial 


institutions as part of its ongoing efforts to: 


e Gain a better understanding of the business of our insti- 
tutional clients in order to deal more effectively with 


appeals and complaints; and 


e Provide IPC mediators and institutional staff with an 
opportunity to better understand each other’s roles and 


needs, and develop more productive relationships. 


We are pleased with the positive response to this initiative. The 
enthusiasm of institutions in meeting and working with our 
mediators, coupled with their creative, yet practical, suggestions 
for projects of joint interest, confirm that there are many ways 
outside the statutory confines of appeals and complaints where 
we can work together to promote an understanding of and 


commitment to the Acts. 


Here are some highlights of our work in 2001 with the municipal 


sector: 


TORONTO POLICE SERVICE 


The exercise of discretion as it relates to the right of access to a 
requester’s own personal information is a key component of the 
access process. It is particularly important for police 
services as they regularly receive requests of this nature. 
Together with the Toronto Police Service, we produced 
Exercising Discretion under section 38(b) of the Municipal Freedom 
of Information and Protection of Privacy Act — A Best Practice for 
Police Services. This Best Practice is equally applicable to all 
municipal and provincial institutions dealing with requests for 
personal information under section 38(b) of the municipal Act or 


section 49(b) of the provincial Act. 


INFORMATION 


FREEDOM OF 
POLICE NETWORK 


Members of the IPC’s municipal mediation team accepted an 
invitation from the Freedom of Information Police Network to 
address its semi-annual meeting and training workshop. More 
than 60 Freedom of Information Co-ordinators and their staff 
from local police services across the province and from the 


Ontario Provincial Police were in attendance. 


CITY OF OTTAWA 


The new City of Ottawa, which had just gone through a major 
amalgamation, wanted to work with the IPC to produce a 
quick reference for its councillors regarding their roles and 
responsibilities under the Act. The guide we produced 
together, Working with the Municipal Freedom of Information 
and Protection of Privacy Act — A Councillor's Guide, provides a 
brief description of the city’s corporate program for access to 
information and protection of privacy, with particular focus on 
how the Act applies to both records requested by municipal 


councilors, and to records in the possession of these councilors. 


And, here are some highlights of our work with the provincial sector: 


MINISTRY OF NATURAL RESOURCES 


The ministry’s Information and Privacy Co-ordinator 
approached the IPC about working on a joint project. Using 
the ministry’s intranet site as our guide, we jointly produced 
the Backgrounder for Senior Managers and Information and 
Privacy Co-ordinators: Raising the profile of Access and Privacy 
in your institution. The Backgrounder includes a number of 


practical suggestions. 
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JOINT EDUCATIONAL SESSIONS — 
JUSTICE SECTOR 


IPC mediators from the provincial team joined with access 
and privacy staff from the ministries of the Attorney General, 
Solicitor General and Correctional Services for a day-long 
educational session. The 2001 session (the third year for this 
program) included a presentation by the IPC on our privacy 
complaint investigation process, and guest speakers from the 
ministry's Special Investigations Unit and Victim Services, 


both of whom explained their programs. 


PROMOTING MEDIATION 


Mediation is the preferred method of dispute resolution at the 
IPC. In 2001, we invited 12 co-ordinators and their staff to a 
meeting. (In most cases, they were relatively new co-ordinators 
or were from institutions that do not receive a large number of 
requests.) The purpose was to talk about our approach in 
mediating appeals and to share with them some of our media- 
tion successes. We also met separately with the Ministry of 
Health co-ordinator and her staff. And finally, we met with the 
access and privacy unit of Management Board Secretariat to 
talk about both our approach to mediation and to provide an 
overview of the varied initiatives we were undertaking as part 


of our Institutional Relations Program. 
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ROEROIUÉES TS Bye tHe PU Bale 


Provincial and municipal government organizations are 
required under the Acts to submit a yearly report to the IPC, 
based on the calendar year, on the number of requests for 
information or corrections to personal information they 
received, how quickly they responded to them, what the results 


were, fees collected, and other pertinent information. 


For the third straight year, the number of freedom of informa- 
tion requests filed with provincial and municipal government 
organizations has increased. Across Ontario, there were 22,761 
requests filed in 2001, compared to 21,768 in 2000, an increase of 
4.56 per cent. 


Provincial government organizations received 11,110 requests, 
compared to 10,824 the previous year. Of these, 3,143 were for 
personal information and 7,967 were for general records. 
Municipal government organizations received a total of 11,651 
requests, compared to 10,944 in 2000. These included 4,410 


requests for personal information and 7,241 for general records. 


The Ministry of Environment, once again, reported the largest 
number of requests received under the provincial Act (3,873). 
The Ministry of Health and Long-Term Care (1,679) was next 
in line, followed by the Ministry of the Solicitor General (1,570) 
and the Ministry of Labour (988). Together, these four ministries 


accounted for 73 per cent of all provincial requests. 


At the municipal level, police services boards received more than 
half (56.5%) of the requests. Municipal corporations (including 
municipal governments) were next (40.5%), followed by school 


boards (1.3%) and boards of health (1.2%). 


Overall, 55.6 per cent of the requests completed under the 
provincial Act were answered within the statutory 30-day 
requirement. (The 30-day compliance percentage for provin- 
cial organizations where a Minister is the head was 52.5 per 


cent.) In all, 78.6 per cent of provincial requests were answered 


within 60 days, a six per cent drop from the previous year. 
Under seven per cent of the requests took more than 120 days, 


up three per cent from 2000. 


As they have for a number of years, municipal government 
organizations outperformed their provincial counterparts by 
responding to 78.4 per cent of the requests within 30 days. 
Overall, 93 per cent of municipal requests in 2001 were 
answered within 60 days, with two per cent taking more than 


120 days to complete. 


(Please see the chapter entitled Response Rate Compliance, 
which follows this chapter, for a more detailed discussion of 


the performance of provincial and municipal organizations.) 


Last year, we began to report on the source of access to infor- 
mation requests. This practice, common in other jurisdictions, 
adds to our knowledge of who utilizes and benefits from the 
freedom of information process. About 65 per cent of the 
requests under the provincial Act were from businesses, the 
same figure as last year. The majority of the requests under the 
municipal Act came from individuals (56%), down slightly 


from just over 62 per cent last year. 


Under the exemption provisions of the Acts, government 
organizations can, and in some cases must, refuse to disclose 
requested information. In 2001, the most frequent exemption 
cited in response to personal information requests was the 
protection of personal information (sections 49 and 38, for 
provincial and municipal organizations, respectively). For 
general record requests, the most frequent exemption cited was 
the protection of personal privacy, (sections 21 and 14 for 


provincial and municipal organizations, respectively). 


Individuals also have the right to request correction of their 
personal information held by government. In 2001, provincial 


organizations received five requests for corrections and refused 
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four. Municipal organizations received 709 correction requests 
and refused 10. When a correction is refused, the requester 
may attach a statement of disagreement to the record, outlining 
why the information is believed to be incorrect. During 2001, 
there were three provincial and nine municipal statements of 


disagreement filed. 


In addition to application fees, the legislation permits govern- 
ment organizations to charge additional fees for providing 
access to information under certain conditions. Where the 
expected charge is over $25, a fee estimate is to be provided 
before work begins. Organizations have discretion to waive 
payment where it seems fair and equitable to do so after 


weighing several specific factors. 


Requests Received and Completed — 2001 
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Provincial institutions reported collecting $52,785.10 in applica- 
tion fees and $273,287.66 in additional fees in 2001. Municipal 
institutions reported receiving $58,071.30 in application fees and 
$120,427.40 in additional fees. 


Provincial organizations most often cited search time as the 
reason for collecting additional fees. Search-time costs were 
mentioned in 50 per cent of cases where fees were collected, 
followed by reproduction costs in 27 per cent and shipping 
costs in 13 per cent. Municipal organizations cited reproduc- 
tion costs in 47 per cent of cases, search time in 25 per cent and 


preparation in 18 per cent. 


Outcome of Municipal Requests — 2001 (%) 
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Municipal Exemptions Used Municipal Exemptions Used 
Personal Information — 2001 General Records — 2001 


Section 38 — Personal Information 1729 (44.1%) Section 14 — Personal Privacy 2391 (58.6%) 


Section 8 — Law Enforcement 1134 (28.9%) Section 8 — Law Enforcement 810 (19.9% ) 


Section 14 — Personal Privacy 745 (19.0%) Other — 640 (15.7 %) 


Other — 315 (8.0 %) Section 10 — Third Party Information 236 (5.8%) 


Provincial Exemptions Used Provincial Exemptions Used 


Personal Information — 2001 General Records — 2001 


Section 49 — Personal Information 970 (88.5%) 


Section 21 — Personal Privacy 1647 (52.4%) 
Other — 65 (5.9 %) 


Other — 747 (23.8%) 


Section 65 (6) — Labour Relations 


Section 14 — Law Enforcement 507 (16.1%) 
and Employment 36 (3.3%) 


Section 19 — Solicitor-Client Privilege 243 (7.7%) 
Section 17 — Third Party Information 25 (2.3%) 


Average Cost of Provincial Requests for 2001 Average Cost of Municipal Requests for 2001 


Personal Information $9.82 Personal Information $7.21 


General Records $42.22 General Records $22.29 


Cases in Which Fees Were Estimated — 2001 


Provincial Municipal 
Collected in Full 38.1% 1487 
Waived in Part 17% 67 
Waived in Full 60.2% 2353 
Total Application Fees Collected (dollars) $58,071.30 
Total Additional Fees Collected (dollars) $120,427.40 
Total Fees Waived (dollars) $5,951.08 
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RESPONSE RATE COMPLIANCE. 


As part of the IPC’s efforts to encourage greater compliance with 
the response requirements of the Acts, we have, starting with the 
1999 annual report, reported on the compliance rates of 
individual government institutions, as well as the overall 
compliance rates for provincial and municipal institutions. The 
accompanying charts continue that process for provincial 


institutions and selected municipal institutions. 


PROVINCIAL INSTITUTIONS 


A number of provincial ministries continued to achieve a high 
level of success in 2001 in meeting the 30-day response stan- 
dard, while receiving a large volume of requests. The IPC 
wishes to recognize their efforts. In addition to the Ministry of 
Health and Long-Term Care — which we will discuss in more 
detail later in this report — the ministries of Community and 
Social Services, Consumer and Business Services, Finance, 
Labour and Transportation answered more than 80 per cent of 
their requests within the required time frame. The Ministry of 
the Attorney General also achieved an impressive compliance 
rate of 86 per cent — up from 72.4 per cent in 2000, which 
pleased us greatly. 


Overall, 55.6 per cent of provincial requests were answered 
within 30 days in 2001, up slightly from 54 per cent in 2000. 
This figure shows the continued, albeit gradual, improvement 
noted in last year’s annual report. The lion’s share of the 
responsibility for sub-standard compliance rests with one 
ministry - the Ministry of the Environment. If this ministry’s 
poor compliance rate (13.6%) is removed from the calculation, 
the overall provincial compliance rate moves to 75.7 per cent, a 


much more acceptable figure. 


In 2001, only six ministries had compliance rates under 60 per 
cent. In addition to the Ministry of the Environment, which 


will be discussed in greater detail below, the Ministry of 
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Energy, Science and Technology was successful in processing 
only one of its 11 requests within the 30-day standard (9.1%); 
the Ministry of Citizenship’s rate was only 38.9 per cent for its 
54 requests; the Ministry of Tourism, Culture and Recreation 
had a compliance rate of only 40 per cent on its 25 requests; and 
the Ministries of Natural Resources and Correctional Services 
had rates of 48 per cent and 54.2 per cent, respectively. In the 
case of the Ministry of Citizenship, if the response rate for one 
of its agencies, the Ontario Human Rights Commission 
(15.8%), is removed from the calculation, that ministry’s 


compliance rate increases dramatically to 93.7 per cent. 


In the 1999 annual report, three ministries were identified as 
having particularly poor compliance rates - Health and Long- 
Term Care, Environment and Natural Resources. The 
ministries of Solicitor General and Correctional Services were 
added to the list in the 2000 annual report. The IPC has been 
participating in a number of joint initiatives with these 
ministries, which, with the exception of Environment, showed 


improvement in compliance in 2001. 


MINISTRY OF HEALTH AND 
LONG-TERM CARE 


The Ministry of Health and Long-Term Care has made remark- 
able progress over the course of the past two years. The ministry’s 
2001 compliance rate was an excellent 83.3 per cent, almost double 
the 43.2 per cent rate of 1999. We know this improvement did not 
come easily. It reflects the diligent work by the Information and 
Privacy co-ordinator and her staff. Equally important, it 
required the demonstrated commitment and support of senior 
ministry officials. All staff involved in these dramatic 
improvements deserve sincere congratulations and recognition 


for their leadership within the Ontario Public Service. 


Provincial: Number of Requests Completed in 2001 (includes only Boards, Agencies and Commissions where the Minister is the Head) 


Ministry Requests Requests Within Within Within More than 
ù Received in Completed in 1-30 days 31-60 days 61-90 days 90 days 
2001 2001 No. of Requests % No. of Requests % No. of Requests % No. of Requests % 
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Cabinet Office da 
Citizenship/OWA Sewer, 
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Correctional Services i 6 À 23.7 
Economic Development & Trade ia Le 0.0 
Education = HD 
Energy, Science & Technology ert ; 36.4 
Environment DCE 18.5 
Ft Mes 
Health and Long-Term Care 62 # 3.4 
Intergovernmental Affairs f 0 0.0 
Labour DCR 
Management Board Secretariat 0 0.0 
Municipal Affairs and Housing Sp RE à 
Natural Resources NPA) 
Northern Development and Mines 274125 
Solicitor General PA: Meur SA 
Tourism, Culture & Recreation - 5 20.0 
Training, Colleges and Universities Fat 
Transportation 3 1.1 
Top Six Municipal Corporations (Population under 50,000) based on numbers of requests completed 
Requests Requests Within Within Within More than 
Received in Completed in 1-30 days 31-60 days 61-90 days 90 days 
2001 2001 No. of Requests % No. of Requests % No. of Requests % No. of Requests % 

Town of Caledon (44,820) 0 | 0.0 
Township of Chatsworth (5,924) re 0 . 0.0 
Township of Dorion (417) 0 SO 
Town of Georgina (35,035) 0 0.0 
County of Haldimand (40,486) 0 0.0 
Town of Halton Hills (44,725) 0 0.0 


ft up 5% or more from 2000 J down 5% or more from 2000 
Tf up 15% or more from 2000 {) down 15% or more from 2000 
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MINISTRY OF NATURAL RESOURCES 


The Ministry of Natural Resources also continues to improve. 
Its compliance rate increased from 30.9 per cent in 2000 to 48 
per cent in 2001. This ministry deals with a high proportion of 
requests that require third party notifications and time exten- 
sions, and when these factors are taken into account, the 
overall compliance rate improves to 65 per cent. There is still 
room for significant improvement, but we are confident that 
the ministry is taking its responsibilities seriously and that 
senior officials and the co-ordinator’s office are committed to 


steady progress on meeting compliance requirements. 


MINISTRY OF THE ENVIRONMENT 


The Ministry of the Environment continues to have serious 
problems. For the second year in a row, the ministry’s 30-day 
compliance rate has declined, dropping from 25.2 per cent in 
2000 to only 13.6 per cent in 2001. This situation is clearly not 
acceptable. It not only means that the needs of requesters under 
the Act are not being met, but the sub-standard performance of 
the ministry is reducing the overall compliance rate for the 
provincial sector by a full 20 per cent. Although the ministry 
started to address its compliance problems during 2001, it has 
been a slow beginning, and steps must be taken to turn the 


situation around during 2002. 


That being said, we are optimistic that this turnaround can be 
achieved, for a number of reasons. Most importantly, senior- 
level ministry officials are now committed to making the 
necessary improvements. The ministry has redesigned the 
management structure for its FOI program, hiring a manager 
to lead a newly formed organization consisting of Freedom of 
Information and Privacy, Environmental Bill of Rights and 
Information Resource Centre programs. The manager in turn 
has put together a multi-year operational plan targeted at 


improved FOI operations in a number of areas. This plan has 
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been approved by senior ministry officials for implementation 
in 2002 and, if successful, the ministry should be positioned to 
realize a dramatic turnaround in the administration of its FOI 
program. Training opportunities have been provided for 
current FOI office staff; additional staff has been approved; 
and a plan has been put in place to analyze and develop options 
for processing routine property-related requests. The ministry 
has also retained a consultant to process backlogged and time- 
sensitive FOI requests, and has approved the acquisition of a case 
management system, a critically important tool for all Freedom 


of Information and Privacy co-ordinators’ offices. 


This ministry has a long way to go. However, with the building 
blocks now in place, the ministry must be in a position to 
demonstrate significant improvement in its compliance rate 


during 2002. 


MINISTRIES OF THE SOLICITOR 
GENERAL AND CORRECTIONAL SERVICES 


The IPC began to work with the Ministries of the Solicitor 
General and Correctional Services because the 30-day compli- 
ance rates for these two ministries in 2000 were under 60 per 
cent. Both of these ministries have improved their performance 
during 2001. The Ministry of the Solicitor General’s compliance 
rate increased by five per cent (to 60%), and the Ministry of 
Correctional Services increased its compliance rate by two per 
cent (to 54%). These improvements were made at the same time 
that the combined request levels for the two ministries increased 


by more than 12 per cent in 2001. 


The Freedom of Information and Privacy (FOIP) office for the 
ministries of the Solicitor General and Correctional Services is 
situated in North Bay. Although part of the broader justice 
cluster, which also includes the Ministry of the Attorney 
General, the North Bay office is largely an autonomous unit, 


with primary decision-making responsibility delegated to the 


Assistant and Deputy Co-ordinators. The record holdings of 
these ministries is heavily weighted to personal information or 
mixed personal information, requiring a high degree of care 


when processing requests. 


For the past several years, the FOIP office has been looking at 
ways to improve the FOI program. A pilot project was intro- 
duced to enhance record-retrieval times, with promising initial 
results; files for Solicitor General/Corrections requests were 
transferred to the Attorney General’s FOIP office for processing, 
to deal with changes in the level of file volumes among the three 
ministries; and a trial “buddy system” was implemented among 
the program analysts in the FOIP office to ensure sufficient 


back-up and support. All of these are positive steps. 


With approximately 270 primary record holder sites between the 
two ministries, one of the main challenges is the delay encoun- 
tered in retrieving records from the field. The expansion of the 
pilot project, if successful, should provide the opportunity to 
introduce improvements for the system as a whole. Because a 
large number of Solicitor General requests involve records held 
by the Ontario Provincial Police, it is important that senior 
management of the police force provide the necessary leadership 
in improving FOI compliance, and that training initiatives 
directed toward OPP officers be implemented. It is also 
important to acknowledge that timely record retrieval is 
dependent on sufficient staffing levels and backup positions in all 


program areas. 


A case management system with good reporting and tracking 
functions is critical to the effective processing of FOI requests, 
particularly in high volume institutions. Given the number of 
requests processed by these ministries, a case management 
system is certainly warranted for these two ministries as well as 


the Ministry of the Attorney General. 


Both ministries have taken good first steps during 2001. 
Effective FOI program administration is now clearly in the 
minds of senior ministry officials, and staff of the FOI office is 
enthusiastic and creative in looking for ways to improve. 
A number of good ideas are on the table, and — with the 
support of senior management —we are optimistic that there 
will be significant levels of improvement during 2002, moving 
both of these ministries out of the sub-standard group of 


provincial institutions as far as compliance rates are concerned. 


MUNICIPAL INSTITUTIONS 


Municipal institutions continued to achieve a higher level of 
compliance with the 30-day standard than provincial institu- 


tions in 2001. Overall, municipal government organizations 


responded to 78.4 per cent of requests within the required time 
frame. This figure is down from the 2000 level of 81.6 per cent, 


and an overall compliance rate of 85 per cent in 1999. 


Like the provincial sector, the overall municipal compliance 
rate is significantly impacted by sub-standard performance of 
one institution, in this case the Toronto Police Service. If this 
institution’s 55.1 per cent compliance rate is removed from the 
calculation, the municipal sector rate increases to 84.5 per cent 
— the superior performance level traditionally met by 


municipal institutions. 


The accompanying charts provide the compliance rates for the 


municipal institutions that responded to the most requests. 


MUNICIPALITIES 


Municipalities have been grouped according to their population. 
Among larger institutions, Mississauga, Ottawa and York 
achieved very high compliance rates. The City of Toronto 
continued to achieve an admirable compliance rate (71.6%), 
despite a significant increase in the number of requests processed 
during 2001. The City of Hamilton also increased its compliance 


rate — to 61.4 per cent, up from 52.4 per cent in 2000. 


Once again, the compliance rates of small to medium-sized 
municipal corporations continued to be outstanding during 
2001. Of note is the fact that, although Oakville and Richmond 
Hill responded to more than triple the number of requests 
during the year, their compliance rates were a remarkable 99.4 


per cent and 97.8 per cent respectively. 


POLICE SERVICES 


With the exception of Toronto, police services generally 
complied with the 30-day standard at a superior rate. Most 
notably, the Halton Regional Police Service maintained the 
perfect record achieved in 2000 by responding to all requests 
within the required time frame. As well, the Niagara Regional 
Police Service increased its compliance rate from 78.9 per cent 


in 2000 to 93.1 per cent in 2001. 


BOARDS OF HEALTH 


This year, the IPC is including the results of boards of health 
in responding to requests for access to information. Although 
the number of requests received by these boards was limited, 
they achieved outstanding results in responding within the 
necessary time frame. We list the five boards with the highest 
number of requests responded to. Four of these reported a 
perfect 100 per cent compliance record in 2001. And the fifth 
had a still outstanding rate of 95.5 per cent. 
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Top Five Municipal Corporations (Population between 50,000 and 200,000) based on numbers of requests completed 


Requests Requests Within Within Within More than 


Received in Completed in 1-30 days 31-60 days 61-90 days 90 days 
2001 2001 No. of Requests % No. of Requests % No. of Requests % No. of Requests % 


City of Burlington (140,288) 

City of Kitchener (177,858) 
County of Lambton (122,405) 
Town of Oakville (132,696) 

Town of Richmond Hill (110,160) 


Top Five Municipal Corporations (Population over 200,000) based on numbers of requests completed 


Requests Requests Within Within Within d More than 
Received in Completed in 1-30 days 31-60 days 61-90 days 90 days 
2001 2001 No. of Requests % No. of Requests % No. of Requests % No. of Requests % 


City of Hamilton (459,638) 
City of Mississauga (549,218) 
City of Ottawa(719,543) 
City of Toronto (2,162,147) 


Regional Municipality of York 
(634,170) 


Top Five Municipal Health Institutions (based on numbers of requests completed) 


Requests Requests Within Within Within More than 
Received in Completed in 1-30 days 31-60 days 61-90 days 90 days 
2001 : 2001 No. of Requests % No. of Requests % No. of Requests % No. of Requests % 


Algoma Health Unit 
Brant County Health Unit 


Hastings & Prince Edward Counties | 
Health Unit 


Oxford County Board of Health 
Windsor-Essex County Health Unit | 


Top Five Police Institutions (based on numbers of requests completed) 


Requests Requests Within Within Within More than 
Received in Completed in 1-30 days 31-60 days 61-90 days 90 days 
2001 2001 No. of Requests % No. of Requests % No. of Requests % No. of Requests % 


Durham Regional Police Service 
Halton Regional Police Service 
Hamilton Police Service 
Niagara Regional Police Service 


Toronto Police Service 


ay up 5% or more from 2000 di down 5% or more from 2000 
ii up 15% or more from 2000 (il down 15% or more from 2000 
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ACCESS 


The concept of any individual being able to access government-held information is one of the 


fundamental principles of accountable government and participatory democracy. 


This principle is reflected in the provincial and municipal Acts, 
which provide that, subject to limited and specific exemptions, 
information under the control of government organizations 
should be available to the public. Records that do not contain 
the personal information of the requester are referred to as 


ce » 
general records. 


If you make a request for records to a provincial or municipal 
government organization under the Ac¢s, and are not satisfied 
with the response, you can appeal the decision to the IPC. 
General records appeals can be filed concerning a refusal to 
provide access to general records, the amount of fees charged, 
the fact that the organization did not respond within the 
prescribed 30-day period, or other procedural aspects relating 
to a request. (Appeals relating to requests for access to one’s 
own personal information are covered in this annual report in 


the chapter entitled Privacy.) 


When an appeal is received, the IPC first attempts to settle it 
informally. If all issues cannot be resolved within a reasonable 
period of time, the IPC may conduct an inquiry and issue a 
binding order, which could include ordering the government 


organization to release all or part of the requested information. 


BETTER UNDERSTANDING 


One of the ongoing goals of the IPC’s Tribunal Services 
Department is to ensure that appellants can easily understand 
the appeal process. In order to help accomplish this, our work 
in 2001 included: 


e Publication of a revised Code of Procedure and Practice 


Directions for appeals under the Acts; 


e Adding a Web-based interactive appeal process flow 


chart; 


e Introducing an optional appeal form, which will assist the 


public when filing an appeal. 


STATISTICAL OVERVIEW 


In 2001, 950 appeals regarding access to general records and 
personal information were made to the IPC, an increase of 11 
per cent over the number of appeals received in 2000. This 
increase did not create a backlog of appeals, as there was a 
corresponding increase in the number of appeals closed. The 
overall number of appeals closed in 2001 was 937, an increase 


of 10 per cent over 2000. 


ACCESS TO GENERAL RECORDS 
Appeals Opened 


Overall, 650 appeals regarding access to general records were 
made to the IPC in 2001. Of these, 396 (61%) were filed under 
the provincial Act and 254 (39%) under the municipal Act. 


Of the 396 provincial general records appeals received, 354 
(89%) involved ministries and 42 (11%) involved agencies. The 
Ministry of Natural Resources was involved in the largest 
number of general records appeals (54). The Ministry of 
Health and Long-Term Care had the next highest number 
(50), followed by Environment (46), the Solicitor General (40) 
and the Attorney General (38). The agencies with the highest 
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number of general records appeals included the Ontario Realty 
Corporation (six), the Ontario Securities Commission (five), 
the Ontario Lottery and Gaming Corporation (four) and the 


Public Guardian and Trustee (four). 


Of the 254 municipal general records appeals received, 158 
(62%) involved police institutions, 61 (24%) involved municipal 
corporations, and 16 (six per cent) involved boards of education. 
An additional 19 appeals (seven per cent) involved other 


categories of municipal institutions. 


In terms of the issues raised, 41 per cent of appeals were related 
to the exemptions claimed by institutions in refusing to grant 
access. An additional 13 per cent concerned exemptions as well 
as other issues. Seventeen per cent of appeals were the result of 
deemed refusals to provide access, in which the institution did 
not respond to the request within the timeframe required by 
the Acts. In about eight per cent of appeals, the issue was 
whether the institution had conducted a reasonable search for 
the records requested. The remaining appeals were related to 


fees, time extensions and other issues. 


While the proportions of each issue in provincial and municipal 
appeals were similar, there were some differences. Specifically, 
while 61 per cent of municipal appeals were related to exemp- 
tions, or exemptions plus other issues, only 50 per cent of 
provincial appeals were related to these two categories. In 
addition, while 20 per cent of provincial appeals were the result 
of deemed refusals, only 13 per cent of municipal appeals were 


the result of this issue. 


Provincial institutions with the largest number of deemed 
refusal appeals included Environment (24), Health and Long- 
Term Care (17), Natural Resources (nine) and the Solicitor 
General (five). Municipal institutions with the largest number 
of deemed refusal appeals included the Township of Stone 
Mills (10), the City of Hamilton (five), the District 
Municipality of Muskoka (five), and the City of Toronto (five). 


Individual members of the public comprised the largest 
proportion of appellants (37%). Another large segment (34% of 
appellants) came from the business sector. Other appellants 
were categorized as media (15%), government (five per cent), 
politicians (four per cent), associations (three per cent), unions 
(one per cent), and academics/researchers (0.3%). In comparing 
provincial and municipal appeals, appellants under the 
provincial legislation were more likely to be from the govern- 
ment, politician or media categories, and appellants under the 
municipal legislation were more likely to be individuals or from 


the business sector. 
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Lawyers (117) and agents (nine) represented appellants in 19 


per cent of the general records appeals. 


In 2001, $12,212 in application fees for general records appeals 
was paid to the IPC. 


Appeals Closed 


The IPC closed 626 general records appeals during 2001. Of 
these, 379 (61%) concerned provincial institutions and 247 


(39%) involved municipal institutions. 


Seventy-four per cent of general records appeals were closed 
without the issuance of a formal order. Of the appeals closed by 
means other than order, one per cent were screened out, 63 per 
cent were successfully mediated, 32 per cent were withdrawn, 
three per cent were abandoned, and one per cent were 
dismissed without an inquiry. In comparing the outcomes of 
provincial and municipal appeals, provincial appeals were some- 
what more likely to be successfully mediated than municipal 
appeals, and municipal appeals were somewhat more likely to be 


withdrawn than provincial appeals. 


Of the 626 general records appeals closed in 2001, 19 per cent 
were closed during the intake stage, 53 per cent were closed 
during the mediation stage, and 28 per cent were closed during 


the adjudication stage. 


Of the appeals closed during the intake stage, 95 per cent were 
withdrawn and five per cent screened out. Of those closed 
during the mediation stage, approximately 89 per cent were 
successfully mediated, six per cent were withdrawn, three per 
cent abandoned, and three per cent were closed by issuing a 
formal order. Of the appeals closed during the adjudication 
stage, 85 per cent were closed by issuing a formal order, 10 per 
cent were withdrawn, two per cent were abandoned, two per 
cent were dismissed without an inquiry, and one per cent were 


successfully mediated. 


In 2001, 26 per cent of general records appeals were closed by 
issuing an order. The IPC issued a total of 147 final orders - 93 
provincial and 54 municipal orders. In addition, the IPC issued 


19 interim orders — 13 provincial and six municipal. 


In the general records appeals resolved by order, the decision of 
the head was upheld in 38 per cent and partly upheld in 37 per 
cent of cases. The head’s decision was not upheld in about 19 
per cent of the appeals closed by order. Seven per cent of the 


orders issued in 2001 had other outcomes. 


Issues in General Records Appeals 


Exemptions 


Exemptions with Other Issues 


Deemed Refusal 
Reasonable Search 
Interim Decision 
Third Party 

Fees 

Time Extension 
Inadequate Decision 
Frivolous/Vexatious Request 
Transfer 

Other 

Total 


Types of Appellants 


Academic/Researcher 
Business 

Government 
Individual 

Media 
Association/Group 
Politician 

Union 


Total 


Provincial 


157 
41 
80 
su 


396 


Provincial 


% 


39.6 
10.4 
20.2 


100.0 


% 


0.3 
31.3 
7.80 
31.8 
VT. 

3.8 

5.8 

1.5 

100.0 


Municipal % Total % 
112 44.1 269 41.4 
42 16.5 83 12.8 
33 13.0 113 17.4 
16 6.3 50 7.7 
8 3.1 22 3.4 

4 1.6 35 5.4 

5 2.0 9 1.4 

5 2.0 8 12 

5 2.0 6 9 
10 3.9 10 1.5 
3 5 

14 5.5 42 6.4 
254 100.0 650 100.0 
Municipal % Total % 
1 0.4 2 0.3 
96 37.8 220 33.8 
4 1.6 35 5.4 
117 46.0 243 37.4 
27 10.6 97 14.9 
6 2.4 21 3.2 
23 3.5 

3 12 9 1.4 
254 100.0 650 100.0 


The number of appeals closed by order may not correspond to the number of orders Overall, the IPC issued a total of 224 final orders — 147 pertaining to access to general 


issued, since one appeal may require more than one order, and one order may close more records and 77 pertaining to access to personal information. Also, the IPC issued 23 


than one appeal. 


interim orders — 19 pertaining to access to general records and four pertaining to access 


to personal information. 
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Outcome of Appeals Closed Other Than by Order 


Provincial % Municipal % Total % 


Screened Out 
Successfully Mediated 
Withdrawn 
Abandoned 

No Inquiry 

Total 


Outcome of Appeals Closed by Order 


Heaa’s Decision Provincial % Municipal % Total 


Upheld 
Partly Upheld 
Not Upheld 
Omen 
Total 


Outcome of Appeals by Stage Closed 


Ordered 151 (85.3%) 
Withdrawn 17 (9.6%) 
No Inquiry 4 (2.3%) 
Abandoned 3 (1.7%) 
Successfully Mediated 2 (1.1%) 
Total 177 (100.0%) 


Withdrawn 114 (95.0%) 
Screened Out 6 (5.0%) 
Total 120 (100.0%) 


Intake 


Adjudication 


Successfully Mediated 292 (88.8%) 
Withdrawn 18 (5.5%) 
Ordered 10 (3.0%) 
Abandoned 9 (2.7%) 
Total 329 (100.0%) 
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PRIVACY 


COMPLAINTS 


To protect personal privacy, the provincial and municipal Acts 
establish rules that govern the collection, retention, use, 
disclosure, security, and disposal of personal information held 


by government organizations. 


If you believe a provincial or municipal government organization 
has failed to comply with one of the Acts and that your privacy 
has been compromised as a result, you can file a complaint with 
the Information and Privacy Commission. The IPC will look 
into the complaint. In many cases, we attempt to mediate 
a solution. The IPC may make formal recommendations to a 


government organization to amend its practices. 


PROCESS CHANGES EFFECTIVE 


In October 2000, the IPC’s Tribunal Services Department 
implemented a new process for privacy complaints. As a result, 
the privacy complaint process improved significantly and 


measurably during 2001. The following sets out some of the 
highlights: 


eThe introduction of an expanded Registrar role and 
intake function meant that more than half of all 
complaints resolved in 2001 were resolved in the intake 


stage; 


e Almost one-third of all complaints resolved in 2001 
were resolved in the new intake resolution stream, 
rather than going through the more formal investiga- 


tion stream; 


e The addition of a Web-based interactive privacy 


complaint process flow chart; 


eThe introduction of an optional privacy complaint 
form, which will assist the public when filing a privacy 


complaint. 


PROBING PRIVACY COMPLAINTS 


Ninety-six privacy complaints were opened in 2001. Fifty-five 
complaints (57%) were filed under the provincial Act and 36 
complaints (38%) were filed under the municipal Act. Five addi- 
tional non-jurisdictional complaints were filed in 2001. Overall, 


there were 23 per cent more privacy complaints than in 2000. 


2001. These 


complaints involved 102 issues. The disclosure of personal 


The IPC closed 95 privacy complaints in 


information was the most frequent issue, raised in 74 per cent 
of complaints. The collection of personal information was an 
issue in 21 per cent, while the use of personal information was 
an issue in seven per cent of complaints. Five per cent of the 
complaints involved other issues, including notice of collection, 


access and general privacy issues. 


While processing privacy complaints, the IPC continues to 
emphasize informal resolution. Consistent with this approach, 
the majority of complaints — 76 per cent — were closed without 


the issuance of a privacy complaint report. 


About 53 per cent of complaints were closed during the intake 
stage. Of those closed during intake, six per cent were screened 
out, 36 per cent were withdrawn, and 58 per cent were resolved 


informally. 


Forty-seven per cent of complaints proceeded to the investiga- 
tion stage. Of the complaints closed during this stage, two per 
cent were abandoned, four per cent were withdrawn, 42 per cent 
were settled, and 51 per cent were closed by issuing a report. 
Twenty-three privacy complaint reports were issued in 2001. 
These reports contained 30 recommendations to government 


organizations. 
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Summary of Privacy Complaints - 2001 


2000 Privacy Complaints 2001 Privacy Complaints 
Provincial Municipal Non- Total Provincial Municipal Non- Total 
jurisdictional jurisdictional 


Opened 
Closed 


Privacy Complaints by Type of Resolution 


Provincial Municipal Non- Total 
jurisdictional 


Screened out 
Abandoned 
Withdrawn 

Settled 

Informal Resolution 
Report 

Total 


Issues* in Privacy Complaints 


Provincial -_ Municipal Non- Total 
jurisdictional 


Disclosure 


Collection 


Notice of Collection 
Use 


Access 


General Privacy 


Total 


* The number of issues does not equal the number of complaints, as some complaints may involve more than one issue. 


Privacy Complaints by Type of Resolution and Stage Closed 


Intake Investigation Total 


Screened out 

Abandoned M 
Withdrawn 

Settled 

Informal Resolution 

Report 

Total 
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Outcome of Issues* in Privacy Complaints 


Provincial Municipal Non- Total 
jurisdictional 


Did not comply with the Act Pie 
Complied with the Act bere 
Partially complied ARE 
Act does not apply & Fa i ? 
Not personal information Sa PE 
Resolved — Finding not necessary ot 
A 

Unable to conclude Fa 
Total 102 
* The number of issues does not equal the number of complaints, as some complaints may involve more than one issue. 
Source of Complainants 

Provincial Municipal Non- Total 

jurisdictional 

Individual 280.5 84 
IPC Commissioner Initiated : iy 11 
Total 95 
Number of Privacy Complaints Closed 1998-2001 

Provincial Municipal Non- Total 

jurisdictional 

1998 _% 
1999 88 
2000 82 
2001 95 


= 4 
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Sixty-three per cent of the issues raised in the privacy complaints 
were resolved without the need for a finding. Institutions were 
found to have complied with the Acts with respect to seven per 
cent and partially complied with respect to one per cent of the 
issues. Institutions were found not to have complied with Acts 
with respect to 14 per cent of the issues. In 11 per cent of the 
issues, the Acts were found not to apply. No conclusion was 
reached with respect to four per cent of the issues. And one per 


cent of the issues were found not to involve personal information. 


Of the 95 complaints closed in 2001, 88 pér cent were initiated 
by members of the public and 12 per cent were initiated by the 


Commissioner. 


PERSONAL INFORMATION APPEALS 


The Acts also provide a right of access to and correction of your 


personal information. 


If you make a request for your personal information to a 
provincial or municipal government organization under the Acts, 
and are not satisfied with the response, you can appeal the 
decision to the IPC. Personal information appeals can be filed 
concerning a refusal to provide access to your personal informa- 
tion, a refusal to correct your personal information, the amount 
of fees charged, the fact that the organization did not respond 
within the prescribed 30-day period, or other procedural aspects 
relating to a request. (Appeals relating to requests for access to 


general records are covered in the chapter entitled Access.) 


When an appeal is received, the IPC first attempts to settle it 
informally. If all the issues cannot be resolved within a reason- 
able period of time, the IPC may conduct an inquiry and issue 
a binding order, which could include ordering the government 


organization to release all or part of the requested information. 


STATISTICAL OVERVIEW 


In 2001, 950 appeals regarding access to general records and 
personal information were made to the IPC, an increase of 11 
per cent over the number of appeals received in 2000. This 
increase did not create a backlog of appeals, as there was a cor- 
responding increase in the number of appeals closed. The 
overall number of appeals closed in 2001 was 937, an increase 


of 10 per cent over the number of appeals closed in 2000. 
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ACCESS AND CORRECTION 
OF ONE’S PERSONAL INFORMATION 


Appeals Opened 


Overall, 300 appeals regarding access or correction of one’s 
personal information were made to the IPC in 2001. Of these, 
111 (37%) were filed under the provincial Act and 188 (62%) 
were filed under the municipal Act. One additional non-juris- 


dictional personal information appeal was made in 2001. 


Of the 111 provincial personal information appeals received, 90 
(81%) involved ministries and 21 (19%) involved agencies. 
The Solicitor General was involved in the largest number of 
personal information appeals (50). Correctional Services had 
the next highest number of personal information appeals (13), 
followed by Community and Social Services (nine), Health and 
Long-term Care (seven) and the Attorney General (four). The 
agencies with the highest number of personal information 
appeals included the Ontario Human Rights Commission 
(seven), the Ontario Civilian Commission on Police Services 


(six), and the Workplace Safety and Insurance Board (three). 


Of the 188 municipal personal information appeals received, 
125 (67%) involved police institutions, 43 (23%) involved 
municipal corporations, and 14 (seven per cent) involved 
boards of education. An additional six (three per cent) appeals 


involved other categories of municipal institutions. 


Forty-eight per cent of personal information appeals were 
related to the exemptions claimed by institutions in refusing to 
grant access. An additional 12 per cent concerned exemptions 
as well as other issues. Ten per cent of personal information 
appeals were the result of deemed refusals to provide access, in 
which the institution did not respond to the request within the 
time frame required by the Acts. In about 13 per cent of 
appeals, the issue was whether the institution had conducted a 
reasonable search for the records requested. Three per cent of 
appeals related to correction requests. The remaining appeals 


were related to fees, time extensions and various other issues. 


In comparing municipal and provincial appeals, reasonable 
search and deemed refusals were more likely to be issues in 
provincial appeals. Correction of personal information was more 
likely to be an issue in municipal appeals than in provincial 
appeals. In addition, municipal personal information appeals 
generally raised a broader range of issues than did provincial 
personal information appeals (e.g., frivolous or vexatious 


requests, fees, and time extensions). 


The number of deemed refusal appeals pertaining to personal 
information was much lower than the number of deemed 
refusal appeals pertaining to general records. No provincial or 
municipal institution had more than three deemed refusal 


appeals pertaining to personal information. 


Lawyers (81) or agents (four) represented appellants in 28 per 


cent of the personal information appeals. 


In 2001, the IPC collected $2,251 in application fees for 


personal information appeals. 


Appeals Closed 


The IPC closed 310 personal information appeals during 2001. 
Of these, 119 personal information appeals closed this year 
concerned provincial institutions, while 190 (61%) involved 
municipal institutions. One additional non-jurisdictional 


personal information appeal was closed in 2001. 


Seventy-six per cent of personal information appeals were 
closed without the issuance of a formal order. Of the appeals 
closed by means other than order, five per cent were screened 
out, 53 per cent were successfully mediated, 37 per cent were 
withdrawn, three per cent were abandoned, and one per cent 


were dismissed without an inquiry. 


Of the 310 personal information appeals closed in 2001, 25 per 
cent were closed during the intake stage, 47 per cent were 
closed during the mediation stage, and 27 per cent were closed 


during the adjudication stage. 


Of the appeals closed during the intake stage, 82 per cent were 
withdrawn, 15 per cent were screened out and three per cent 
were abandoned. Of the appeals closed during the mediation 
stage, 85 per cent were successfully mediated, 10 per cent were 
withdrawn, three per cent were abandoned, and one per cent 
were closed by issuing a formal order. Of the appeals closed 
during the adjudication stage, 85 per cent were closed by issuing 
a formal order, 10 per cent were withdrawn, three per cent were 


dismissed without an inquiry, and one per cent were abandoned. 


In 2001, 24 per cent of personal information appeals were 
closed by issuing an order. The IPC issued a total of 77 final 
orders for personal information appeals — 25 provincial and 52 
municipal.' In addition, the IPC issued four interim orders — 


two provincial and two municipal. 


In appeals resolved by order, the decision of the head was 
upheld in 59 per cent and partly upheld in 28 per cent of cases. 
The head’s decision was not upheld in only approximately five 
per cent of the appeals closed by order. Seven per cent of the 


orders issued in 2001 had other outcomes. In comparing the 


outcomes of provincial and municipal orders, the decision of 
the head was more likely to be upheld in municipal orders, and 
more likely to be partly upheld in provincial orders. The head’s 
decision was not upheld in twice as many provincial orders as 
compared to municipal orders, and there were twice as many 
municipal orders with outcomes other than a head’s decision 


being upheld, partly upheld or not upheld. 


! The number of appeals closed by order may not correspond to the number of orders 
issued, since one appeal may require more than one order, and one order may close more 


than one appeal. 


Outcome of Appeals Closed by Order 


Municipal 
Head’s Decision 


Upheld 32 
Partly Upheld 11 
Not Upheld 2 
Other 4 


Total 49 


Provincial 
Head’s Decision 
Upheld 12 


Partly Upheld 10 
Not Upheld 2 


Other 1 
Total 25 


Outcome of Appeals Closed Other Than by Order 


Municipal 


Successfully Mediated 76 


Withdrawn 51 


Screened Out 8 
Abandoned 4 


No Inquiry 2 


Total 141 


Provincial 


Successfully Mediated 49 


Withdrawn 36 


Screened Out 4 


Abandoned 4 


No Inquiry 1 
Total 94 


*One additional non-jurisdictional appeal was withdrawn in 2001 
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Outcome of Appeals by Stage Closed 


Withdrawn 64 (82.0%) 
Screened Out 12 (15.4%) 
Abandoned 2 (2.6%) 
Total 78 (100.0%) 


Ordered 72 (84.7%) 
Withdrawn 9 (10.6%) 
No Inquiry 3 (3.5%) 
Abandoned 1 (1.2%) 
Total 85 (100.0%) 


Mediation 


Successfully Mediated 125 (85.0%) 
Withdrawn 15 (10.2%) 
Abandoned 5 (3.4%) 
Ordered 2 (1.4%) 
Total 147 (100.0%) 


Issues in Personal Information Appeals 


Provincial % Municipal % Total % 


Exemptions 

Exemptions with Other Issues 
Deemed Refusal 

Reasonable Search 

Interim Decision 

Third Party 

Fees 

Time Extension 

Inadequate Decision 
Frivolous/Vexatious Request 
Transfer 

Correction 

Other 

Total 


* One additional non-jurisdictional personal information appeal was filed in 2001. 
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JUDICIAL REVIEWS 


2001 saw several important decisions of the courts that both 
upheld and reversed IPC orders. Four of these decisions are the 
subject of applications for leave to appeal to higher courts, 
so that the issues dealt with here may not be finally resolved. 
Other decisions reaffirmed fundamental principles of access 
and privacy rights involving personal information and general 


records. 


In last year’s annual report, we noted that Ontario’s Court of 
Appeal had recently heard three government appeals from 
Divisional Court rulings upholding the IPC’s interpretation of 
exclusions for labour relations and employment records. In 
August 2001, the Court of Appeal released its judgment 
reversing the Divisional Court and overturning the IPC’s 
rulings. Records that the IPC had found were subject to the 
provincial Act, the Court of Appeal found to be excluded. In a 
single ruling encompassing all three appeals, the Court rejected 
the IPC’s requirement that government show a “current legal 
interest” in the subject matter of a record in order for the 


exclusions to apply. 


The IPC had reasoned that unless government had a current 
interest in a labour or employment matter that could affect its 
legal rights or obligations, and thus upset the balance in its 
labour and employee relations, the underlying purpose for 
excluding records did not exist. In the IPC’s view, records 
about past matters which had long since concluded, or could 
not otherwise affect government’s legitimate interests, should 
be subject to the normal access and privacy rules established 


under the Act by the exemptions. 


The Court of Appeal rejected this approach. In its view, the 
words “in which an institution has an interest” simply refer to 
matters involving government’s own work force. The Court 
also held that IPC decisions concerning the exclusions are not 


entitled to deference because they affect the IPC’s jurisdiction 


under the Act. Accordingly, it was not obliged to defer to the 
IPC’s interpretation even though it may have been “reason- 
able.” The IPC has brought an application to the Supreme 
Court of Canada seeking leave to appeal from the Court of 
Appeal’s decision, in light of the potential for erosion of access 
and privacy rights that may not be justified given the purpose 


and wording of the exclusions. 


The IPC also saw its traditional “reasonableness” standard of 
review eroded in a case within its jurisdiction involving a claim 
of solicitor-client privilege under section 19 of the Act. The IPC 
held that records prepared by or for Crown counsel in connection 
with criminal charges and a trial were protected to the same 
extent as records prepared in private litigation by or for non- 
government lawyers. Applying common law principles of 
“litigation privilege,” the IPC held that the records sought would 
have been exempt as long as the prosecution was ongoing, but 
that the privilege ended on completion of the litigation. Most of 
the records at issue contained personal information and were 
subject to the personal privacy exemption at section 21 of the 
Act in any event. However, the Commissioner ordered disclo- 
sure of the remaining records, which did not contain personal 


information. 


The Divisional Court overturned this decision because it did not 
agree that the common law rules should apply to Crown counsel 
records. The Court found fault in the IPC’s decision to consider 
statements by the former Attorney General who introduced the 
legislation, as reported in Hansard, which supported the IPC’s 
interpretation. The Court also held that the IPC’s decision should 
be reviewed on a “correctness” and not a “reasonableness” 
standard of review because common law solicitor-client privilege 
did not engage the IPC’s specialized expertise. However, the 
Court did not take issue with the IPC’s statement of the common 
law rules, disagreeing only with the IPC’s interpretation that 


these rules should apply to government Crown counsel. 
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The Divisional Court’s ruling is in apparent conflict with 
rulings of the Court of Appeal that IPC decisions interpreting 
and applying the exemptions under the Act are subject to 
review on a reasonableness standard, and are entitled to the 
court’s deference. By failing to give effect to the legislative 
history, the Divisional Court’s ruling affords Crown counsel a 
privilege “more expansive and durable” than in any other 
solicitor-client context. Because this outcome may tend to 
undermine bureaucratic accountability in the conduct of 
government litigation, the IPC is seeking leave to appeal this 


decision to the Court of Appeal for Ontario. 


Provincial institutions are also seeking to challenge two 
Divisional Court rulings in 2001 that upheld IPC orders on a 
reasonableness standard of review. In one case involving the 
Ministry of Health and Long -Term Care, the IPC found that 
records listing the top 10 items billed by an unnamed physician 
did not contain personal information and must be disclosed. In 
another case, the IPC ordered Ontario’s Public Guardian and 
Trustee to disclose a listing of individuals who had died intes- 
tate, including their names, addresses, dates and places of 
death, and last occupations. In this case, the IPC found that 
disclosure would not cause pecuniary harm to affected persons, 
but would, in fact, benefit unknown heirs by making addi- 
tional resources available to locate and assist them in claiming 
their inheritances. Accordingly, disclosure was not an unjusti- 


fied invasion of the privacy of the deceased individuals. 


Two other decisions of the Divisional Court involving personal 
information are also worthy of note. In one case, the Divisional 
Court upheld as reasonable the IPC’s decision ordering the 
Ontario Lottery and Gaming Corporation (OLGC) to disclose 
the salary ranges of its employees. In that case, section 21(4)(b) 
of the Act provided that disclosure of such information was not 
an unjustified invasion of privacy. The Court agreed with 


the IPC that its previous decision in another judicial review 
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Outstanding Judicial Reviews as of December 31, 2001: 36° 
Launched by: 


Institutions: 28 ° 


Requesters: 8 


Affected Parties: 0 


New applications received in 2001: 15 


Judicial Reviews Closed/Heard in 2001: 13 


Heard but Not Closed (subject to appeal): 7 


Abandoned (IPC order stands): 3° 


IPC Order Upheld: 2° 


Dismissed for Delay: 1‘ 


IPC Orders Not Upheld: 0 


‘Includes 13 judicial reviews on hold pending other court rulings 
"Abandoned: IPC order stands: MO-1213, MO-1251, PO-1805 
‘Orders upheld: PO-1706, PO-1763 

‘Dismissed for Delay (IPC order stands): P1-609/R-980050 


application was dispositive of the issues raised by the OLGC. 
In another case, the Court upheld the Commissioner’s ruling that 
the Ministry of the Environment was bound by the mandatory 
exemption at section 21 to refuse to disclose the name of an 
environmental whistle blower to the person who was allegedly in 
breach of environmental regulations. Each of these cases 
involved issues that had previously been decided in the courts. 
Accordingly, the applicants were ordered by the Court to pay the 


IPC its costs as a deterrent to unnecessary litigation. 


Nded@iecivbyad 
OUTREACH PROGRAM 


One of the IPC’s key responsibilities is to help educate 


QUIN 


Ontarians about their access and privacy rights. To help 
address this mandate, the IPC — for the fourth consecutive year 


— expanded its Outreach program in 2001. 
The Outreach program has five core elements: 
e School program 
e Speeches and presentations 
e IPC publications 
+ Media relations 


e Web site 


SCHOOL PROGRAM 


The IPC launched the third phase of its school program in 2001, 
a guide for Grade 11 and 12 teachers, What Students Need to 
Know About Freedom of Information and Protection of Privacy. 
The latest guide, primarily aimed at Grade 11 and 12 law 
teachers, is the third produced by the IPC. The other two are 
guides for Grade 5 social studies teachers (the level where stu- 
dents first study government) and Grade 10 civics teachers (the 


civics curriculum includes freedom of information and privacy). 


During 2001, nearly 5,000 copies of the IPC’s teacher’s kits and 
brochures were downloaded from the educational resources 


section of the IPC’s Web site. 


To help promote the guides, the IPC made presentations to 
history and social studies consultants at five school boards 
during 2001, and also made copies of the newest guide avail- 
able at a secondary school teachers’ conference. In addition, 
IPC staff made more than 50 presentations to Grade 5 social 


studies classes as part of our Ask an Expert program. 
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All three guides — and brochures outlining each of them — are 
available on the IPC’s Web site: 


www.ipc.on.ca/english/resources/resources.htm. 


SPEECHES AND PRESENTATIONS 


Commissioner Cavoukian was a keynote speaker at a 
number of major conferences in 2001 and also made special 
presentations at universities and to various groups. Among 
these were a presentation to senior government officials at 
the Values and Ethics of Privacy conference in Ottawa, which 
was organized by the Conference Board of Canada; the 
Privacy Summit organized by IBM and Tivoli in Toronto; an 
e-Government in Ontario conference, and The Human Face of 
Privacy Technology conference, which was sponsored by the 
IPC and the University of Waterloo. Among others, she also 
made presentations to the Centre for Foreign Policy 
Development; the Ontario Bar Association; the Ontario 
Hospital Association; the Public Affairs Association of 
Canada; the Association of Municipalities of Ontario, and to 
faculty and students at the University of Toronto, 


University of Ottawa and Carlton University. 
Other segments of the IPC’s speakers’ program include: 


e the Reaching out to Ontario program, under which a team 
of speakers — led by the Commissioner or the Assistant 
Commissioner — visit a region of Ontario and make 
presentations to various groups. In 2001, IPC teams 
visited Ottawa, the Niagara Region, Sudbury and 


Kitchener - Waterloo. 


an expanded media program, under which the IPC's 
communications co-ordinator addresses college and 
university journalism or electronic media classes, and 


workshops at newspapers and other media. 
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ea university program, where senior members of the 


IPC’s Policy and Legal Departments make presenta- 
tions to faculty and students in business, technology and 


law programs. 


e a general public speaking program, where IPC staff make 
presentations on access and privacy to various groups or 
organizations. Presentations in 2001 included two at 
specially arranged professional development seminars 
(one in central Ontario; one in western Ontario) for senior 


librarians. 


IPC PUBLICATIONS 


The IPC released 17 publications or submissions in 2001, 
including a Privacy Diagnostic Tool (PDT) workbook. The 
PDT is a self-assessment tool that the IPC created with the 
assistance of Guardent and PricewaterhouseCoopers. It helps 
businesses gauge their privacy readiness by comparing their 
information processes with international privacy guidelines. 
(Free copies of the PDT are also available in three different 
software formats on the IPC’s Web site.) 


Other 2001 publications include Guidelines for Using Video 
Surveillance Cameras in Public Places, and If you wanted to 
know... How to access your personal information held by the 
province, which explains where to find and how to use the 


Directory of Records and the Directory of Institutions. 
A full list of all IPC publications released in 2001 follows this 


Outreach report. 


MEDIA RELATIONS 


As media reports are one of the ways that many Ontario 
residents learn about specific access and privacy issues, the IPC 


has both pro-active and responsive media relations programs. 
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The Commissioner is the official spokesperson for the IPC and 
accepts as many media requests for interviews as her schedule 
allows. During 2001, the Commissioner gave 85 interviews — to 
Ontario, Canadian and international newspaper, magazine, 
TV, and radio reporters. In addition, as part of the IPC’s efforts 
to focus attention on freedom of information and privacy 
issues, the Commissioner or Assistant Commissioner met with 


the editorial boards of five Ontario newspapers in 2001. 


IPC WEB SITE 


Another key element of the Outreach program is the IPC’s 
Web site, which contains an extensive amount of information 
about access and privacy issues and legislation. As well as all 
IPC publications and orders, there are copies of the two Acts, 
educational material, common questions and answers about 
access and privacy, press releases, selected speeches and other 
presentations, and a section — How Things Work — that is 
designed to help the public understand how things work at the 
IPC, such as what happens when the IPC receives a privacy 
complaint, or what the IPC's approach is to mediating appeals. 
Among the many other sections is one where you can find links 


to other Web sites that focus on access and/or privacy. 


information about site 


For detailed the Web 


(www.ipc.on.ca), see the chapter that follows Publications. 


more 


p U BLI C AT | 0 N S ¢ Privacy Diagnostic Tool — a self-assessment program used 


to help businesses gauge their privacy readiness by 


The IPC’s publications program is one of the cornerstones of ee tS 
comparing their information processes with international 


its Outreach program. As well as its annual report and two privacy principles. It was developed by the IPC with the 


newsletters, the IPC — each year — produces a number of policy assistance of Guardent and PricewaterhouseCoopers. 


papers, brochures and specialty publications. 
+ An Internet Privacy Primer: Assume Nothing is a 


The publications and major submissions released in 2001, in collaboration by the IPC and Microsoft Canada that 


order of publication, were: outlines the risks individuals should be aware of when 


+ FA.O.: Frequently Asked Questions: Access and Privacy in using the Internet. 


the School System, jointly produced by the IPC and the 


A Grade 11/12 teacher’s guide, What Students Need to 


Toronto District School Board as a resource for parents, Know about Freedom of Information and Protection of 


teachers and administrators. Privacy, the third teacher’s guide produced by the IPC 


e Police Officers’ Notebooks and the Municipal Freedom of as part of its school program. 
Information and Protection of Privacy Act: A Guide for 
Police Officers, jointly produced by the IPC and Durham 
Regional Police. It was prepared to help clarify the treat- 


Guidelines for Using Video Surveillance Cameras in Public 
Places are guidelines to assist institutions in deciding 


whether the collection of personal information by 


ment of police officers’ notebooks under the Act, and to means of a video surveillance system is lawful and justi- 


facilitate the processing of access requests that involve this fiable as a policy choice, and — if so — how privacy 


type of record. protective measures can be built into the system. 


+ Submission and Speaking Notes for presentation to the 


If you wanted to know... How to access your personal infor- 
Standing Committee on General Government reviewing 


Bill 159, the Personal Health Information Privacy Act, 
2000. 


mation held by the province explains where to find and how 


to use the Directory of Records and Directory of Institutions. 


Working with the Municipal Freedom of Information and 


+ Second Presentation to the Standing Committee on General Protection of Privacy Act: A Councillor’s Guide, jointly 


Government: Bill 159: Personal Health Information produced by the IPC and the City of Ottawa, focuses on 


Privacy Act, 2000. This document reinforces the main how the Act applies to both records requested by, and in 


points from the IPC’s first submission and responds to the possession of, elected members of council. 


some of the comments made by other stakeholders. 


Fall 2001 edition of Perspectives. 


eA submission in response to the federal Access to 


: : , : rounder for Senior Managers and Information and 
Information Review Task Force’s consultation paper. ES. one fe 


Privacy Co-ordinators: Raising the profile of access and pri- 
e Ç 7 ] A 1 ] 1 , = : . . . . . ds 
Best Practices for Online Privacy Protection is an educa vacy in your institution. Each provincial and municipal 


tive tool designed to help companies identify and imple- government organization has a co-ordinator. This back- 


ment appropriate practices for protecting the privacy of grounder, jointly produced by the IPC and the Ministry of 


their online customers. Natural Resources, looks at ways co-ordinators can help 


° Spring 2001 edition of the IPC’s bi-annual newsletter, others integrate an awareness and understanding of access 


Perspectives. and privacy into their daily work. 


—_— 


+ Commissioner Ann Cavoukian’s annual report for 2000. All IPC publications are available on the IPC’s Web site, 
www.ipc.on.ca, or by calling the Communications Department 


at 416-326-3333 or 1-800-387-0073 to request copies of specific 


publications. 


e Guidelines for Protecting the Privacy and Confidentiality 
of Personal Information When Working Outside the Office 
provides best practices and tips to assist government 
organizations in developing policies that address the 
privacy obligations of employees who are working in 


locations outside the traditional office setting. 
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IPC WEB SITE 


The IPC continues to expand and enhance its Web site, 


www.ipc.on.ca, one of its key educational tools. 


Among the enhancements to the site in 2001, the scope of the 
Educational Resources section was broadened and renamed 
Resources. The educational resources portion of this section has 
been expanded with the addition of a new teacher’s guide — for 
Grade 11 and 12 teachers — and an updated guide for Grade 10 
civics teachers. Another addition is a new paper, FA.Q.: 
Frequently Asked Questions: Access and Privacy in the School 
System. 


The other major section of Resources is devoted to the Privacy 
Diagnostic Tool (PDT). Developed by the IPC with the assistance 
of security and privacy experts at Guardent and 
PricewaterhouseCoopers, this free self-assessment tool can be 
used to compare an organization’s business information processes 
against international privacy principles, known as fair informa- 
tion practices. In addition to a print version, electronic versions of 


the PDT are available in three different software formats. 


Other changes to the Web site in 2001 include the addition of 


new charts and forms to assist the public. 


The IPC’s Tribunal Services Department created electronic 
procedure charts, which can be found in the How Things Work 
segment of the Our Role section. These “plain language” visual 
interpretations use diagrams to outline the steps involved in the 
appeal and privacy complaint processes and provide definitions 


of common appeal and complaint process terminology. 


Complementing these charts are newly created appeal and 
privacy complaint forms, in the Forms section of the Web site. 
The appeal form can be used for filing an appeal to the IPC 
against a decision made by a government organization relating 


to a request made under the provincial or municipal Acts. The 
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complaint form can be used for filing a privacy complaint with 
the IPC if you believe a provincial or municipal government 
organization has improperly collected, used or disclosed your 


personal information. 


WEB INFORMATION RESOURCES 


Each year, thousands of copies of IPC publications, forms and 
other materials are downloaded from or referenced on the Web 


site. In 2001, almost 38,000 .pdf versions were downloaded. 


Consistent with the IPC’s mandate to promote routine disclo- 
sure, all IPC orders are posted to the Web site. They are 
accessed not only by those members of the public who are 
involved in appeals themselves, and by the legal profession and 
government organizations, but have proven to be a solid point 
of reference to the media, and those who wish to gain an 
overview of a particular issue or the appeal process. In 2001, the 


orders section was accessed more than 90,000 times. 


Among the IPC’s most popular publications are the three 
teacher’s guides and related brochures. Nearly 5,000 copies of 


these educational resources were downloaded in 2001. 


Another popular resource is the Privacy Diagnostic Tool. In less 
than half a year (it was released last August), more than 4,200 


copies were downloaded. 


The IPC’s annual reports are also frequently accessed or down- 
loaded. The 2000 annual report was accessed thousands of 
times and about 1,400 copies were downloaded in 2001 (it was 
released last June). In addition, nearly 1,000 copies of the 1999 
report were downloaded last year (primarily during the first 


half of the year, before the 2000 report was released). 


The IPC is constantly updating and improving the resources 
available on its Web site. Questions and feedback are always 


welcome. Please address comments to: info@ipc.on.ca. 


MONITORING LEGISLATION 
AND PROGRAMS 


Part of the mandate of the IPC under the Freedom of Information 
and Protection of Privacy Act is to offer comment on the privacy 
protection and access implications of proposed government 
legislative schemes or government programs. We take this man- 
date very seriously and were pleased with the extent to which 
ministries sought our advice during 2001. The following list 
provides an overview of the work done by the IPC during 2001 


that focused on provincial government activities. 


Ministry Consultations: 


+ Ministry of Agriculture and Food: Food Safety and 
Quality Act; 


e Ministry of the Attorney General: Remedies for 
Organized Crime and Other Unlawful Activities Act; 
authorization for Indirect Collection relating to the 


Ontario Emergency Victim Assistance Program; 


Ministry of Finance: Public Sector Accountability Act; 
Protocol for the disclosure of information relating to the 


sale of the Province of Ontario Savings Office; 


Ministry of Transportation: implementation of the Road 
User Customer Service Improvement Act; consultation on 
the annual report of the Ontario Highway Transport 
Board; consultation with the Transponder Research 


Project; comment on the Ignition Interlock Program; 


Ministry of Correctional Services: implementation of 
initiatives pursuant to the Corrections Accountability Act; 
review of Memorandum of Understanding for exchange 
of information with Citizenship and Immigration 


Canada; 


Ministry of the Solicitor General: Sex Offender Registry 


implementation; 


Ministry of Community and Social Services: Mandatory 
drug treatment for social assistance recipients; review of 


Family Responsibility Office contracts; 


Ministry of the Environment: Environet; 


Ministry of Health and Long-Term Care: Hepatitis C 
Transfusion Notification Plan; Personal Health Privacy 
Legislation; consultation on the Trillium Gift of Life 
Network; review of Smart Systems for Health and the 


ePhysician project; 


+ Ministry of Consumer and Business Services: Integrated 
address change project; Personal Property Security Act 
access project; private sector privacy legislation; amend- 


ments to the Vital Statistics Act; 


e Ministry of Education: Ontario Student Number 
regulations; proposal for an elementary/secondary data 
warehouse; EQAO practices; regulation on the collec- 


tion of personal information pursuant to the Safe Schools 


Act, 2000; 


+ Ministry of Colleges and Universities: amendments to 


the Ontario Educational Communications Authority Act; 


+ Ontario Securities Commission: System for Electronic 


Disclosure for Insiders (SEDI); 


e Ontario Public Guardian and Trustee: amendments to 


the Public Guardian and Trustee Act. 


Submissions Prepared: 


+ Submission to the Standing Committee on General 
Government re: Bill 159: the Personal Health 
Information Privacy Act, 2000; 


+ Second submission to the Standing Committee on 
General Government re: Bill 159: Personal Health 
Information Privacy Act, 2000; 


e Submission in response to the federal Access to 


Information Review Task Force’s consultation paper; 


e A submission to the Canadian Radio-Television and 
Telecommunications Commission regarding Public 
Notice CRTC 2001-56 and three submissions to the 
Commission regarding Public Notice CRTC 2001-60-1. 
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ORGANIZATIONAL CHART 
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Commissioner 


Director of 


Policy & 


Compliance 


Policy & 
Research 


Compliance 


Assistant 
Commissioner 

& Head of 
Tribunal Services 


Registrar & Mediatic 
Tribunal 


Support 


Adjudication 


Salaries and Wages 

Employee Benefits 

Transportation and Communications 
Services 

Supplies and Equipment 

Total 


2001-2002 
Estimates $ 


5,154,500 
799,000 
162,300 
860,500 
273,200 

7,249,500 


2000-2001 
Estimates $ 


4,732,600 
922,900 
163,700 
876,200 
256,100 

6,951,500 


2000-2001 
Actual $ 


4,059,302 
842,272 
IS i 
839,531 
266,129 

6,734,355 
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APPENDIX | 


Public Sector Salary Disclosure Act for the Calendar Year Ending December 31, 2001 


Employees paid $100,000 or more in 2001 


Surname Position Salary Paid Taxable Benefits 
Cavoukian, Ann Commissioner $157,826.31 $380.34 
Mitchinson, Tom Assistant Commissioner $187,109.83 $381.55 
Anderson, Ken Director, Legal and Corporate Services $178,033.66 $369.24 
Beamish, Brian Director, Policy & Compliance $104,925.52 $242.69 
Challis, William General Counsel $178,642.96 $365.48 
Goldstein, Judith Legal Counsel $140,177.46 $284.40 
Goodis, David Senior Adjudicator/Manager, Adjudication $139,052.09 $283.39 
Higgins, John Legal Counsel $153,714.26 $313.33 
O’ Donoghue, Mary Manager, Legal Services $143,526.08 $287.62 
Swaigen, John Legal Counsel $157,822.69 $320.25 


Prepared under the Public Sector Salary Disclosure Act, 1996 


(Please note: Some of these amounts include retroactive payments during 2001 for past years.) 
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